Bug 1800809

Summary: Could not forward logs to rsyslog server
Product: OpenShift Container Platform Reporter: Jeff Cantrill <jcantril>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: medium    
Version: 4.3.0CC: anli, aos-bugs, mburke, ocasalsa
Target Milestone: ---   
Target Release: 4.3.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1799024 Environment:
Last Closed: 2020-03-24 14:33:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1799024, 1812918, 1824003    
Bug Blocks:    

Comment 3 Anping Li 2020-03-15 10:44:02 UTC
Verified in 4.3.7

Comment 4 Anping Li 2020-03-15 10:49:18 UTC
From 4.3.7, we need use a new method to enable fluentd send logs to external syslog server

1) create a configmap named syslog

echo '<store>
     @type syslog
     remote_syslog rsyslogserver.openshift-logging.svc.cluster.local
     port 514
     hostname $hostname
     remove_tag_prefix tag
     tag_key ident,systemd.u.SYSLOG_IDENTIFIER
     facility local0
     severity info
     use_record true
     payload_key message
</store>' >syslog.conf
oc create configmap syslog --from-file=syslog.conf -n openshift-logging

2) restart fluentd pod
oc delete pod --selector logging-infra=fluentd


For more detail, refer to https://docs.openshift.com/container-platform/4.3/logging/config/cluster-logging-log-forwarding.html.

Comment 6 errata-xmlrpc 2020-03-24 14:33:06 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0858