mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 13:08:11 +00:00
Remove unneeded intermediate folders
This commit is contained in:
Billy Tat
+128
@@ -0,0 +1,128 @@
|
||||
---
|
||||
title: Cluster Logging
|
||||
shortTitle: Logging
|
||||
description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
|
||||
metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
|
||||
weight: 3
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/tasks/logging/
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/
|
||||
---
|
||||
|
||||
Logging is helpful because it allows you to:
|
||||
|
||||
- Capture and analyze the state of your cluster
|
||||
- Look for trends in your environment
|
||||
- Save your logs to a safe location outside of your cluster
|
||||
- Stay informed of events like a container crashing, a pod eviction, or a node dying
|
||||
- More easily debug and troubleshoot problems
|
||||
|
||||
Rancher supports integration with the following services:
|
||||
|
||||
- Elasticsearch
|
||||
- Splunk
|
||||
- Kafka
|
||||
- Syslog
|
||||
- Fluentd
|
||||
|
||||
This section covers the following topics:
|
||||
|
||||
- [How logging integrations work](#how-logging-integrations-work)
|
||||
- [Requirements](#requirements)
|
||||
- [Logging scope](#logging-scope)
|
||||
- [Enabling cluster logging](#enabling-cluster-logging)
|
||||
|
||||
# How Logging Integrations Work
|
||||
|
||||
Rancher can integrate with popular external services used for event streams, telemetry, or search. These services can log errors and warnings in your Kubernetes infrastructure to a stream.
|
||||
|
||||
These services collect container log events, which are saved to the `/var/log/containers` directory on each of your nodes. The service collects both standard and error events. You can then log into your services to review the events collected, leveraging each service's unique features.
|
||||
|
||||
When configuring Rancher to integrate with these services, you'll have to point Rancher toward the service's endpoint and provide authentication information.
|
||||
|
||||
Additionally, you'll have the opportunity to enter key-value pairs to filter the log events collected. The service will only collect events for containers marked with your configured key-value pairs.
|
||||
|
||||
>**Note:** You can only configure one logging service per cluster or per project.
|
||||
|
||||
# Requirements
|
||||
|
||||
The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
|
||||
|
||||
```
|
||||
$ docker info | grep 'Logging Driver'
|
||||
Logging Driver: json-file
|
||||
```
|
||||
|
||||
# Logging Scope
|
||||
|
||||
You can configure logging at either cluster level or project level.
|
||||
|
||||
- Cluster logging writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
|
||||
- [Project logging]({{<baseurl>}}/rancher/v2.0-v2.4/en/project-admin/tools/logging/) writes logs for every pod in that particular project.
|
||||
|
||||
Logs that are sent to your logging service are from the following locations:
|
||||
|
||||
- Pod logs stored at `/var/log/containers`.
|
||||
- Kubernetes system components logs stored at `/var/lib/rancher/rke/log/`.
|
||||
|
||||
# Enabling Cluster Logging
|
||||
|
||||
As an [administrator]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.0-v2.4/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send Kubernetes logs to a logging service.
|
||||
|
||||
1. From the **Global** view, navigate to the cluster that you want to configure cluster logging.
|
||||
|
||||
1. Select **Tools > Logging** in the navigation bar.
|
||||
|
||||
1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services:
|
||||
|
||||
- [Elasticsearch]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-admin/tools/logging/elasticsearch/)
|
||||
- [Splunk]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-admin/tools/logging/splunk/)
|
||||
- [Kafka]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-admin/tools/logging/kafka/)
|
||||
- [Syslog]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-admin/tools/logging/syslog/)
|
||||
- [Fluentd]({{<baseurl>}}/rancher/v2.0-v2.4/en/cluster-admin/tools/logging/fluentd/)
|
||||
|
||||
1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
|
||||
|
||||
- With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
|
||||
|
||||
- [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
|
||||
- [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
|
||||
- [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
|
||||
- [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
|
||||
- [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
|
||||
|
||||
- If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
|
||||
1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
|
||||
|
||||
- You can use either a self-signed certificate or one provided by a certificate authority.
|
||||
|
||||
- You can generate a self-signed certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.
|
||||
|
||||
1. (Optional) Complete the **Additional Logging Configuration** form.
|
||||
|
||||
1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
|
||||
|
||||
1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
|
||||
|
||||
1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
|
||||
|
||||
1. Click **Test**. Rancher sends a test log to the service.
|
||||
|
||||
> **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
|
||||
|
||||
1. Click **Save**.
|
||||
|
||||
**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
|
||||
|
||||
## Related Links
|
||||
|
||||
[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
|
||||
+47
@@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Elasticsearch
|
||||
weight: 200
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/tools/logging/elasticsearch/
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging/elasticsearch
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/elasticsearch
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/elasticsearch
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/elasticsearch/
|
||||
---
|
||||
|
||||
If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs.
|
||||
|
||||
>**Prerequisites:** Configure an [Elasticsearch deployment](https://www.elastic.co/guide/en/cloud/saas-release/ec-create-deployment.html).
|
||||
|
||||
## Elasticsearch Deployment Configuration
|
||||
|
||||
1. In the **Endpoint** field, enter the IP address and port of your Elasticsearch instance. You can find this information from the dashboard of your Elasticsearch deployment.
|
||||
|
||||
* Elasticsearch usually uses port `9200` for HTTP and `9243` for HTTPS.
|
||||
|
||||
1. If you are using [X-Pack Security](https://www.elastic.co/guide/en/x-pack/current/xpack-introduction.html), enter your Elasticsearch **Username** and **Password** for authentication.
|
||||
|
||||
1. Enter an [Index Pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html).
|
||||
|
||||
## SSL Configuration
|
||||
|
||||
If your instance of Elasticsearch uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
|
||||
|
||||
1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
|
||||
|
||||
- You can use either a self-signed certificate or one provided by a certificate authority.
|
||||
|
||||
- You can generate a self-signed certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
|
||||
1. Enter your **Client Key Password**.
|
||||
|
||||
1. Enter your **SSL Version**. The default version is `TLSv1_2`.
|
||||
|
||||
1. Select whether or not you want to verify your SSL.
|
||||
|
||||
* If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
|
||||
* If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
title: Fluentd
|
||||
weight: 600
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging/fluentd
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/fluentd
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/fluentd
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/fluentd/
|
||||
---
|
||||
|
||||
If your organization uses [Fluentd](https://www.fluentd.org/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Fluentd server to view logs.
|
||||
|
||||
>**Prerequisites:** Configure Fluentd input forward to receive the event stream.
|
||||
>
|
||||
>See [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/in_forward) for details.
|
||||
|
||||
## Fluentd Configuration
|
||||
|
||||
You can add multiple Fluentd Servers. If you want to add additional Fluentd servers, click **Add Fluentd Server**. For each Fluentd server, complete the configuration information:
|
||||
|
||||
1. In the **Endpoint** field, enter the address and port of your Fluentd instance, e.g. `http://Fluentd-server:24224`.
|
||||
|
||||
1. Enter the **Shared Key** if your Fluentd Server is using a shared key for authentication.
|
||||
|
||||
1. Enter the **Username** and **Password** if your Fluentd Server is using username and password for authentication.
|
||||
|
||||
1. **Optional:** Enter the **Hostname** of the Fluentd server.
|
||||
|
||||
1. Enter the load balancing **Weight** of the Fluentd server. If the weight of one server is 20 and the other server is 30, events will be sent in a 2:3 ratio. If you do not enter a weight, the default weight is 60.
|
||||
|
||||
1. If this server is a standby server, check **Use as Standby Only**. Standby servers are used when all other servers are not available.
|
||||
|
||||
After adding all the Fluentd servers, you have the option to select **Enable Gzip Compression**. By default, this is enabled because the transferred payload size will be reduced.
|
||||
|
||||
## SSL Configuration
|
||||
|
||||
If your Fluentd servers are using TLS, you need to select **Use TLS**. If you are using a self-signed certificate, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
|
||||
|
||||
>**Note:** Fluentd does not support self-signed certificates when client authentication is enabled.
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Kafka
|
||||
weight: 400
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/tools/logging/kafka/
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging/kafka
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/kafka
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/kafka
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/kafka/
|
||||
---
|
||||
|
||||
If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Kafka server to view logs.
|
||||
|
||||
>**Prerequisite:** You must have a Kafka server configured.
|
||||
|
||||
## Kafka Server Configuration
|
||||
|
||||
1. Select the type of **Endpoint** your Kafka server is using:
|
||||
|
||||
* **Zookeeper**: Enter the IP address and port. By default, Zookeeper uses port `2181`. Please note that a Zookeeper endpoint cannot enable TLS.
|
||||
* **Broker**: Click on **Add Endpoint**. For each Kafka broker, enter the IP address and port. By default, Kafka brokers use port `9092`.
|
||||
|
||||
1. In the **Topic** field, enter the name of a Kafka [topic](https://kafka.apache.org/documentation/#basic_ops_add_topic) that your Kubernetes cluster submits logs to.
|
||||
|
||||
## **Broker** Endpoint Type
|
||||
|
||||
### SSL Configuration
|
||||
|
||||
If your Kafka cluster is using SSL for the **Broker**, you need to complete the **SSL Configuration** form.
|
||||
|
||||
1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
|
||||
|
||||
1. Provide the **CA Certificate PEM**. You can either copy and paste the certificate or upload it using the **Read from a file** button.
|
||||
|
||||
>**Note:** Kafka does not support self-signed certificates when client authentication is enabled.
|
||||
|
||||
### SASL configuration
|
||||
|
||||
If your Kafka cluster is using [SASL authentication](https://kafka.apache.org/documentation/#security_sasl) for the Broker, you need to complete the **SASL Configuration** form.
|
||||
|
||||
1. Enter the SASL **Username** and **Password**.
|
||||
|
||||
1. Select the **SASL Type** that your Kafka cluster is using.
|
||||
|
||||
* If your Kafka is using **Plain**, please ensure your Kafka cluster is using SSL.
|
||||
|
||||
* If your Kafka is using **Scram**, you need to select which **Scram Mechanism** Kafka is using.
|
||||
@@ -0,0 +1,81 @@
|
||||
---
|
||||
title: Splunk
|
||||
weight: 300
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/tasks/logging/splunk/
|
||||
- /rancher/v2.0-v2.4/en/tools/logging/splunk/
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging/splunk
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/splunk
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/splunk/
|
||||
- /rancher/v2.x/en/cluster-admin/tools/logging/splunk
|
||||
---
|
||||
|
||||
If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs.
|
||||
|
||||
>**Prerequisites:**
|
||||
>
|
||||
>- Configure HTTP event collection for your Splunk Server (Splunk Enterprise or Splunk Cloud).
|
||||
>- Either create a new token or copy an existing token.
|
||||
>
|
||||
>For more information, see [Splunk Documentation](http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector#About_Event_Collector_tokens).
|
||||
|
||||
## Splunk Configuration
|
||||
|
||||
1. In the **Endpoint** field, enter the IP address and port for you Splunk instance (i.e. `http://splunk-server:8088`)
|
||||
|
||||
* Splunk usually uses port `8088`. If you're using Splunk Cloud, you'll need to work with [Splunk support](https://www.splunk.com/en_us/support-and-services.html) to get an endpoint URL.
|
||||
|
||||
1. Enter the **Token** you obtained while completing the prerequisites (i.e., when you created a token in Splunk).
|
||||
|
||||
1. In the **Source** field, enter the name of the token as entered in Splunk.
|
||||
|
||||
1. **Optional:** Provide one or more [index](http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Aboutindexesandindexers) that's allowed for your token.
|
||||
|
||||
## SSL Configuration
|
||||
|
||||
If your instance of Splunk uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
|
||||
|
||||
1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
|
||||
|
||||
- You can use either a self-signed certificate or one provided by a certificate authority.
|
||||
|
||||
- You can generate a self-signed certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
|
||||
1. Enter your **Client Key Password**.
|
||||
|
||||
1. Select whether or not you want to verify your SSL.
|
||||
|
||||
* If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
|
||||
* If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
|
||||
|
||||
## Viewing Logs
|
||||
|
||||
1. Log into your Splunk server.
|
||||
|
||||
1. Click on **Search & Reporting**. The number of **Indexed Events** listed should be increasing.
|
||||
|
||||
1. Click on Data Summary and select the Sources tab.
|
||||
|
||||
|
||||
1. To view the actual logs, click on the source that you declared earlier.
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
You can use curl to see if **HEC** is listening for HTTP event data.
|
||||
|
||||
```
|
||||
$ curl http://splunk-server:8088/services/collector/event \
|
||||
-H 'Authorization: Splunk 8da70994-b1b0-4a79-b154-bfaae8f93432' \
|
||||
-d '{"event": "hello world"}'
|
||||
```
|
||||
|
||||
If Splunk is configured correctly, you should receive **json** data returning `success code 0`. You should be able
|
||||
to send logging data to HEC.
|
||||
|
||||
If you received an error, check your configuration in Splunk and Rancher.
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
title: Syslog
|
||||
weight: 500
|
||||
aliases:
|
||||
- /rancher/v2.0-v2.4/en/tools/logging/syslog/
|
||||
- /rancher/v2.0-v2.4/en/cluster-admin/tools/logging/syslog
|
||||
- /rancher/v2.0-v2.4/en/logging/legacy/cluster-logging/syslog
|
||||
- /rancher/v2.0-v2.4/en/logging/v2.0.x-v2.4.x/cluster-logging/syslog
|
||||
- /rancher/v2.x/en/logging/v2.0.x-v2.4.x/cluster-logging/syslog/
|
||||
---
|
||||
|
||||
If your organization uses [Syslog](https://tools.ietf.org/html/rfc5424), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Syslog server to view logs.
|
||||
|
||||
>**Prerequisite:** You must have a Syslog server configured.
|
||||
|
||||
If you are using rsyslog, please make sure your rsyslog authentication mode is `x509/name`.
|
||||
|
||||
## Syslog Server Configuration
|
||||
|
||||
1. In the **Endpoint** field, enter the IP address and port for your Syslog server. Additionally, in the dropdown, select the protocol that your Syslog server uses.
|
||||
|
||||
1. In the **Program** field, enter the name of the application sending logs to your Syslog server, e.g. `Rancher`.
|
||||
|
||||
1. If you are using a cloud logging service, e.g. [Sumologic](https://www.sumologic.com/), enter a **Token** that authenticates with your Syslog server. You will need to create this token in the cloud logging service.
|
||||
|
||||
1. Select a **Log Severity** for events that are logged to the Syslog server. For more information on each severity level, see the [Syslog protocol documentation](https://tools.ietf.org/html/rfc5424#page-11).
|
||||
|
||||
- By specifying a **Log Severity** does not mean that will act as a filtering mechanism for logs. To do that you should use a parser on the Syslog server.
|
||||
|
||||
## Encryption Configuration
|
||||
|
||||
If your Syslog server is using **TCP** protocol and uses TLS, you need to select **Use TLS** and complete the **Encryption Configuration** form.
|
||||
|
||||
1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
|
||||
|
||||
- You can use either a self-signed certificate or one provided by a certificate authority.
|
||||
|
||||
- You can generate a self-signed certificate using an openssl command. For example:
|
||||
|
||||
```
|
||||
openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
|
||||
```
|
||||
|
||||
1. Select whether or not you want to verify your SSL.
|
||||
|
||||
* If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
|
||||
* If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
|
||||
Reference in New Issue
Block a user