Integrating with EFK Logging Stack on OpenShift
Understanding cluster logging
As a cluster administrator, you can deploy cluster logging to aggregate all the logs from your OpenShift Container Platform cluster, such as node system audit logs, application container logs, and infrastructure logs. Cluster logging aggregates these logs from throughout your cluster and stores them in a default log store. You can use the Kibana web console to visualize log data.
Cluster logging aggregates the following types of logs:
- Application: Container logs generated by user applications running in the cluster, except infrastructure container applications.
- Infrastructure: Logs generated by infrastructure components running in the cluster and OpenShift Container Platform nodes, such as journal logs. Infrastructure components are pods that run in the openshift*, kube*, or default projects.
- Audit: Logs generated by the node audit system (auditd), which are stored in the /var/log/audit/audit.log file, and the audit logs from the Kubernetes apiserver and the OpenShift apiserver.
About cluster logging components
The cluster logging components include a collector deployed to each node in the OpenShift Container Platform cluster that collects all node and container logs and writes them to a log store. You can use a centralized web UI to create rich visualizations and dashboards with the aggregated data.
The major components of cluster logging are:
- Collection: This is the component that collects logs from the cluster, formats them, and forwards them to the log store. The current implementation is Fluentd.
- Log store: This is where the logs are stored. The default implementation is Elasticsearch. You can use the default Elasticsearch log store or forward logs to external log stores. The default log store is optimized and tested for short-term storage.
- Visualization: This is the UI component you can use to view logs, graphs, charts, and so forth. The current implementation is Kibana.