Chapter 4. Configure collector settings

Procedure

1. Modify the ClusterLogForwarder CR to add configuration for the http receiver input:

   Example ClusterLogForwarder CR

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: <clusterlogforwarder_name>
     namespace: <namespace>
   # ...
   spec:
     serviceAccount:
       name: <service_account_name>
     inputs:
     - name: http-receiver
       type: receiver
       receiver:
         type: http
         port: 8443
         http:
           format: kubeAPIAudit
     outputs:
     - name: <output_name>
       type: http
       http:
         url: <url>
     pipelines:
       - name: http-pipeline
         inputRefs:
           - http-receiver
         outputRefs:
           - <output_name>
   # ...

   metadata.name

   Specify a name for the ClusterLogForwarder CR.

   inputs.name

   Specify a name for your input receiver.

   inputs.receiver.type

   Specify the input receiver type as http.

   inputs.receiver.port

   Optional: Specify the port that the input receiver listens on. This must be a value between 1024 and 65535. The default value is 8443 if this is not specified.

   inputs.receiver.http.format

   Currently, only the kube-apiserver webhook format is supported for http input receivers.

   pipelines

   Configure a pipeline for your input receiver.

2. Apply the changes to the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml

3. Verify that the collector is listening on the service that has a name in the <clusterlogforwarder_resource_name>-<input_name> format by running the following command:

   $ oc get svc

   Example output

   NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)            AGE
   collector                 ClusterIP   172.30.85.239    <none>        24231/TCP          3m6s
   collector-http-receiver   ClusterIP   172.30.205.160   <none>        8443/TCP           3m6s

   In the example, the service name is collector-http-receiver.

Verification

1. Extract the certificate authority (CA) certificate file by running the following command:

   $ oc extract cm/openshift-service-ca.crt -n <namespace>

   Note

   If the CA in the cluster where the collectors are running changes, you must extract the CA certificate file again.

2. As an example, use the curl command to send logs by running the following command:

   $ curl --cacert <openshift_service_ca.crt> https://collector-http-receiver.<namespace>.svc:8443 -XPOST -d '{"<prefix>":"<message>"}'

   Replace <openshift_service_ca.crt> with the extracted CA certificate file.

Procedure

1. Grant the collect-infrastructure-logs cluster role to the service account by running the following command:

   Example binding command

   $ oc adm policy add-cluster-role-to-user collect-infrastructure-logs -z logcollector

2. Modify the ClusterLogForwarder CR to add configuration for the syslog receiver input:

   Example ClusterLogForwarder CR

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: <clusterlogforwarder_name>
     namespace: <namespace>
   # ...
   spec:
     serviceAccount:
       name: <service_account_name>
     inputs:
       - name: syslog-receiver
         type: receiver
         receiver:
           type: syslog
           port: 10514
     outputs:
     - name: <output_name>
       lokiStack:
         authentication:
           token:
             from: serviceAccount
         target:
           name: logging-loki
           namespace: openshift-logging
       tls:
         ca:
           key: service-ca.crt
           configMapName: openshift-service-ca.crt
       type: lokiStack
   # ...
     pipelines:
       - name: syslog-pipeline
         inputRefs:
           - syslog-receiver
         outputRefs:
           - <output_name>
   # ...

   spec.serviceAccount.name

   Use the service account that you granted the collect-infrastructure-logs permission in the previous step.

   spec.inputs.name

   Specify a name for your input receiver.

   spec.inputs.receiver.type

   Specify the input receiver type as syslog.

   spec.inputs.receiver.port

   Optional: Specify the port that the input receiver listens on. This must be a value between 1024 and 65535.

   spec.outputs.tls

   If TLS configuration is not set, the default certificates will be used. For more information, run the command oc explain clusterlogforwarders.spec.inputs.receiver.tls.

   spec.pipelines

   Configure a pipeline for your input receiver.

3. Apply the changes to the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml

4. Verify that the collector is listening on the service that has a name in the <clusterlogforwarder_resource_name>-<input_name> format by running the following command:

   $ oc get svc

   Example output:

   NAME                        TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)            AGE
   collector                   ClusterIP   172.30.85.239    <none>        24231/TCP          33m
   collector-syslog-receiver   ClusterIP   172.30.216.142   <none>        10514/TCP          2m20s

   In this example output, the service name is collector-syslog-receiver.

Verification

1. Send a test syslog message using the logger command by running the following command:

   $ logger --tcp --server collector-syslog-receiver.<namespace>.svc --port 10514 “test message”

   Replace <namespace> with the namespace where the collector service is running.

Procedure

1. Update the ClusterLogForwarder CR:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: my-forwarder
     namespace: openshift-logging
   spec:
     collector:
       maxUnavailable: <value>

   Where <value> can be a number or percentage. If you do not specify a value, the default value of 100% is used for the maxUnavailable field.

2. Apply the ClusterLogForwarder CR by running the following command:

   $ oc apply -f <filename>.yaml