|
6 | 6 | [id="logging-architecture-overview_{context}"] |
7 | 7 | = Logging architecture |
8 | 8 |
|
9 | | -The {logging} consists of these logical components: |
10 | | - |
11 | | -* `Collector` - Reads container log data from each node and forwards log data to configured outputs. |
12 | | -
|
13 | | -* `Store` - Stores log data for analysis; the default output for the forwarder. |
14 | | -
|
15 | | -* `Visualization` - Graphical interface for searching, querying, and viewing stored logs. |
16 | | -
|
17 | | -These components are managed by Operators and Custom Resource (CR) YAML files. |
| 9 | +The major components of the {logging} are: |
| 10 | + |
| 11 | +Collector:: The collector is a daemonset that deploys pods to each {product-title} node. It collects log data from each node, transforms the data, and forwards it to configured outputs. You can use the Vector collector or the legacy Fluentd collector. |
| 12 | ++ |
| 13 | +-- |
| 14 | +include::snippets/logging-fluentd-dep-snip.adoc[] |
| 15 | +-- |
| 16 | + |
| 17 | +Log store:: The log store stores log data for analysis and is the default output for the log forwarder. You can use the default LokiStack log store, the legacy Elasticsearch log store, or forward logs to additional external log stores. |
| 18 | ++ |
| 19 | +-- |
| 20 | +include::snippets/logging-elastic-dep-snip.adoc[] |
| 21 | +-- |
| 22 | + |
| 23 | +Visualization:: You can use a UI component to view a visual representation of your log data. The UI provides a graphical interface to search, query, and view stored logs. If you are using LokiStack as the default log storage, the {product-title} web console UI is provided by enabling the {product-title} console plugin. If you are using Elasticsearch as the default log storage, you can use Kibana. |
| 24 | ++ |
| 25 | +-- |
| 26 | +include::snippets/logging-kibana-dep-snip.adoc[] |
| 27 | +-- |
18 | 28 |
|
19 | 29 | The {logging-title} collects container logs and node logs. These are categorized into types: |
20 | 30 |
|
21 | | -* `application` - Container logs generated by user applications running in the cluster, except infrastructure container applications. |
22 | | -
|
23 | | -* `infrastructure` - Logs generated by infrastructure components running in the cluster and {product-title} nodes, such as journal logs. Infrastructure components are pods that run in the `openshift*`, `kube*`, or `default` projects. |
24 | | -
|
25 | | -* `audit` - Logs generated by auditd, the node audit system, which are stored in the */var/log/audit/audit.log* file, and logs from the `auditd`, `kube-apiserver`, `openshift-apiserver` projects, as well as the `ovn` project if enabled. |
| 31 | +Application logs:: Container logs generated by user applications running in the cluster, except infrastructure container applications. |
26 | 32 |
|
27 | | -The logging collector is a daemonset that deploys pods to each {product-title} node. System and infrastructure logs are generated by journald log messages from the operating system, the container runtime, and {product-title}. |
| 33 | +Infrastructure logs:: Container logs generated by infrastructure namespaces: `openshift*`, `kube*`, or `default`, as well as journald messages from nodes. |
28 | 34 |
|
29 | | -Container logs are generated by containers running in pods running on the cluster. Each container generates a separate log stream. The collector collects the logs from these sources and forwards them internally or externally as configured in the `ClusterLogForwarder` custom resource. |
| 35 | +Audit logs:: Logs generated by auditd, the node audit system, which are stored in the */var/log/audit/audit.log* file, and logs from the `auditd`, `kube-apiserver`, `openshift-apiserver` services, as well as the `ovn` project if enabled. |
0 commit comments