Description of problem: Following the docs for logging aggregation does not work with 3.0 https://docs.openshift.com/enterprise/3.0/admin_guide/aggregate_logging.html Version-Release number of selected component (if applicable): 3.0 How reproducible: 100% Steps to Reproduce: 1. follow steps in docs: https://docs.openshift.com/enterprise/3.0/admin_guide/aggregate_logging.html 2. Make sure the firewall is not blocking port 24230 3. Make sure the master log host is listening to port 24230 Actual results: No logs are seen in /var/log/td-agent/containers.log.* Expected results: docker logs seen in master logs /var/log/td-agent/containers.log.* Additional info:
The problem is not actually reproducible by following the steps in the document pointed at. Note that the documentation refers to a specific RPM version: td-agent-2.2.0-0. This bug was raised from a support request where a newer version had been installed: td-agent-2.2.1-0.el7 The differences in these packages are not documented in the package's [emtpy] changelog, but one of them is in the agent's init script (/etc/init.d/td-agent). In package version 2.2.0-0, configuring an emtpy DAEMON_ARGS= in /etc/sysconfig/td-agent has the side effect of running the agent as 'root'. In package version 2.2.1-0.el7 this has changed though, and with the same configuration the agent runs as user "td-user", and therefore it does have access to container logs in /var/lib/docker. For td-agent-2.2.1-0.el7, adding this to /etc/sysconfig/td-agent avoids the problem by running as root (like the 2.2.0-0 version): TD_AGENT_USER=root TD_AGENT_GROUP=root I'm not sure if this should be turned into a documentation bug or not: - as mentioned, with the steps as they are in the current version of the docs I could not reproduce the problem - these packages are not shipped or maintained by Red Hat - moving forward, OSE 3.1 provides additional facilities for aggregated logging: https://docs.openshift.com/enterprise/3.1/install_config/aggregate_logging.html For all this I'm closing this as "not a bug". Please amend/reopen as appropriate if needed.