I couldn't receive log on the rsyslog server. cat /var/log/fluentd/fluentd.log 2019-05-20 11:09:12 +0000 [warn]: [elasticsearch-apps] buffer flush took longer time than slow_flush_log_threshold: elapsed_time=34.823131942001055 slow_flush_log_threshold=20.0 plugin_id="elasticsearch-apps" 2019-05-20 11:09:45 +0000 [warn]: [elasticsearch-apps] buffer flush took longer time than slow_flush_log_threshold: elapsed_time=32.84825437099971 slow_flush_log_threshold=20.0 plugin_id="elasticsearch-apps" 2019-05-20 11:09:48 +0000 [warn]: [elasticsearch-apps] buffer flush took longer time than slow_flush_log_threshold: elapsed_time=30.94880408499921 slow_flush_log_threshold=20.0 plugin_id="elasticsearch-apps" 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 2019-05-20 11:10:11 +0000 [warn]: [remote-syslog-input] out:syslog: invalid facility value DHCP4; reset to default local0 steps: 1) deploy logging 2) deploy rsyslogs server using cluster-admin in openshift-logging namespace https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/01_createsa.sh https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/02_creatersyslogserver.sh 3) patch cm/fluentd to send logs to rsyslog via UDP https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/03_patchcm.sh 4) Waiting logs in rsyslog server oc logs $rsyslogserver -f
By the ways, I can received the logs when use out_buffer_syslog steps: 1) deploy logging 2) deploy rsyslogs server using cluster-admin in openshift-logging namespace https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/01_createsa.sh https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/02_creatersyslogserver.sh 3) patch cm/fluentd to send logs to rsyslog via UDP https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/logging/rsyslogserver/03_updateds.sh 4) Waiting logs in rsyslog server oc logs $rsyslogserver -f
I had a configuration error. I should export UDP 514 rather than TCP.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758