OpenShift Logging Concepts

External

• https://docs.openshift.com/container-platform/latest/install_config/aggregate_logging.html
• https://docs.openshift.com/container-platform/latest/install_config/install/advanced_install.html#advanced-install-cluster-logging

Internal

• OpenShift Concepts

Overview

OpenShift provides log aggregation with the EFK stack. fluentd is used to capture logs from nodes, pods and application and stored log data in ElasticSearch. Kibana offers a UI for ElasticSearch. fluentd, ElasticSearch and Kibana are deployed as OpenShift pods, on dedicated infrastructure nodes. Logging components communicate securely. They are usually part of the "logging" namespace. Application developers can view the logs for projects they have view access for. Cluster administrators can view all logs.

Logging support is not provided by default but it can be enabled during installation, by setting "openshift_hosted_logging_deploy=true" in the Ansible hosts file.

Installation

Logging must be explicitly enabled during the advanced installation, as described here:

There is also a dedicated Ansible playbook that can be used to deploy and upgrade aggregate logging.

Organizatorium

Docker Container Logs

https://docs.openshift.com/container-platform/latest/install_config/install/host_preparation.html#managing-docker-container-logs

Docker containers use a json-file logging driver and store logs in /var/lib/docker/containers/<hash>/<hash>-json.log

Aggregated logging is only supported using the journald driver in Docker. More details in https://docs.openshift.com/container-platform/latest/install_config/aggregate_logging.html#fluentd-upgrade-source.