Based on the discussion in bz 1513409 OCP 3.9 is going back to json as default log driver for docker. On the of the possibilities we have in fluentd when using json-file or cri-o, is to limit how fast fluentd reads those logs and sends them to Elasticsearch, so that we can throttle logs from "misbehaving" apps, so that they do not overwhelm fluentd and elasticsearch. This needs to be documented to show how it is done, see https://github.com/openshift/origin-aggregated-logging/blob/master/docs/log-drivers-and-throttling.md#log-throttling
Hi Daniel, We have a section, "Throttling logs in Fluentd", with instructions on how to do so. https://docs.openshift.com/container-platform/3.9/install_config/aggregate_logging.html#aggregated-fluentd Do you think this is sufficient? Thanks!
Hey Daniel, just wanted to check in and get your thoughts on Comment 3. Thanks!
LGTM
Commits pushed to master at https://github.com/openshift/openshift-docs https://github.com/openshift/openshift-docs/commit/f88daeb0316caef302c4624cc3fbf6cba4850c05 Bug 1554244 Addition example for throttling logs https://github.com/openshift/openshift-docs/commit/66a65ff62c0dfb76e5075ef513e7e4a6ed5c5667 Merge pull request #11394 from bmcelvee/BZ1554244 Bug 1554244 Addition example for throttling logs
Thank you!
Documentation updated: https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html-single/installation_and_configuration/#aggregated-fluentd