Files
rancher-docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.html
T

17 lines
38 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!doctype html>
<html lang="en" dir="ltr" class="docs-wrapper docs-doc-page docs-version-current plugin-docs plugin-id-default docs-doc-id-reference-guides/best-practices/rancher-managed-clusters/logging-best-practices">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="generator" content="Docusaurus v2.0.0-beta.21">
<link rel="search" type="application/opensearchdescription+xml" title="Rancher Manager" href="/opensearch.xml"><title data-rh="true">Logging Best Practices | Rancher Manager</title><meta data-rh="true" name="twitter:card" content="summary_large_image"><meta data-rh="true" property="og:url" content="http://docs.ranchermanager.rancher.io//reference-guides/best-practices/rancher-managed-clusters/logging-best-practices"><meta data-rh="true" name="docusaurus_locale" content="en"><meta data-rh="true" name="docsearch:language" content="en"><meta data-rh="true" name="docusaurus_version" content="current"><meta data-rh="true" name="docusaurus_tag" content="docs-default-current"><meta data-rh="true" name="docsearch:version" content="current"><meta data-rh="true" name="docsearch:docusaurus_tag" content="docs-default-current"><meta data-rh="true" property="og:title" content="Logging Best Practices | Rancher Manager"><meta data-rh="true" name="description" content="In this guide, we recommend best practices for cluster-level logging and application logging."><meta data-rh="true" property="og:description" content="In this guide, we recommend best practices for cluster-level logging and application logging."><link data-rh="true" rel="icon" href="/img/favicon.png"><link data-rh="true" rel="canonical" href="http://docs.ranchermanager.rancher.io//reference-guides/best-practices/rancher-managed-clusters/logging-best-practices"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/best-practices/rancher-managed-clusters/logging-best-practices" hreflang="en"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//zh/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices" hreflang="zh"><link data-rh="true" rel="alternate" href="http://docs.ranchermanager.rancher.io//reference-guides/best-practices/rancher-managed-clusters/logging-best-practices" hreflang="x-default"><link data-rh="true" rel="preconnect" href="https://30NEY6C9UY-dsn.algolia.net" crossorigin="anonymous"><link rel="stylesheet" href="/assets/css/styles.31d3122a.css">
<link rel="preload" href="/assets/js/runtime~main.14fff006.js" as="script">
<link rel="preload" href="/assets/js/main.a8ed619c.js" as="script">
</head>
<body class="navigation-with-keyboard">
<script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
<div role="region"><a href="#" class="skipToContent_fXgn">Skip to main content</a></div><nav class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Navigation bar toggle" class="navbar__toggle clean-btn" type="button" tabindex="0"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">v2.7</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices">v2.7</a></li><li><a class="dropdown__link" href="/v2.6/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices">v2.6</a></li><li><a class="dropdown__link" href="/v2.5/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active">English</a></li><li><a href="/zh/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices" target="_self" rel="noopener noreferrer" class="dropdown__link">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_lCJq"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div class="main-wrapper docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebar_njMd"><nav class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/getting-started/overview">Getting Started</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/new-user-guides">How-to Guides</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" aria-expanded="true" href="/pages-for-subheaders/best-practices">Reference Guides</a></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/best-practices">Best Practices</a><button aria-label="Toggle the collapsible sidebar category &#x27;Best Practices&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/rancher-server">Rancher Server</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher Server&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-3 menu__list-item"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--active" aria-expanded="true" tabindex="0" href="/pages-for-subheaders/rancher-managed-clusters">Rancher-Managed Clusters</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher-Managed Clusters&#x27;" type="button" class="clean-btn menu__caret"></button></div><ul style="display:block;overflow:visible;height:auto" class="menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link menu__link--active" aria-current="page" tabindex="0" href="/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices">Logging Best Practices</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices">Monitoring Best Practices</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers">Tips for Setting Up Containers</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-4 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere">Best Practices for Rancher Managed vSphere Clusters</a></li></ul></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/rancher-manager-architecture">Rancher Manager Architecture</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher Manager Architecture&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/cluster-configuration">Cluster Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Cluster Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/single-node-rancher-in-docker">Single-Node Rancher in Docker</a><button aria-label="Toggle the collapsible sidebar category &#x27;Single-Node Rancher in Docker&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/amazon-eks-permissions">Amazon EKS Permissions</a><button aria-label="Toggle the collapsible sidebar category &#x27;Amazon EKS Permissions&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/backup-restore-configuration">Backup &amp; Restore Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Backup &amp; Restore Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/kubernetes-concepts">Kubernetes Concepts</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/monitoring-v2-configuration">Monitoring V2 Configuration</a><button aria-label="Toggle the collapsible sidebar category &#x27;Monitoring V2 Configuration&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/prometheus-federator">Prometheus Federator</a><button aria-label="Toggle the collapsible sidebar category &#x27;Prometheus Federator&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/user-settings">User Settings</a><button aria-label="Toggle the collapsible sidebar category &#x27;User Settings&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/cli-with-rancher">CLI with Rancher</a><button aria-label="Toggle the collapsible sidebar category &#x27;CLI with Rancher&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/about-the-api">About the API</a><button aria-label="Toggle the collapsible sidebar category &#x27;About the API&#x27;" type="button" class="clean-btn menu__caret"></button></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-cluster-tools">Cluster Tools for Logging, Monitoring, and Visibility</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rancher-project-tools">Project Tools for Logging, Monitoring, and Visibility</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/system-tools">System Tools</a></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link" tabindex="0" href="/reference-guides/rke1-template-example-yaml">RKE1 Example YAML</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist" aria-expanded="false" tabindex="0" href="/pages-for-subheaders/rancher-security">Rancher Security</a><button aria-label="Toggle the collapsible sidebar category &#x27;Rancher Security&#x27;" type="button" class="clean-btn menu__caret"></button></div></li></ul></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/pages-for-subheaders/cloud-marketplace">Integrations in Rancher</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/faq/general-faq">FAQ</a></div></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class="menu__list-item-collapsible"><a class="menu__link menu__link--sublist menu__link--sublist-caret" aria-expanded="false" href="/troubleshooting/general-troubleshooting">Troubleshooting</a></div></li><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/contribute-to-rancher">Contributing to Rancher</a></li></ul></nav></div></aside><main class="docMainContainer_gTbr"><div class="container padding-top--md padding-bottom--lg"><div class="row"><div class="col docItemCol_GujU"><div class="docItemContainer_Adtb"><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label="Breadcrumbs"><ul class="breadcrumbs" itemscope="" itemtype="https://schema.org/BreadcrumbList"><li class="breadcrumbs__item"><a aria-label="Home page" class="breadcrumbs__link" href="/"><svg viewBox="0 0 24 24" class="breadcrumbHomeIcon_OVgt"><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill="currentColor"></path></svg></a></li><li class="breadcrumbs__item"><span class="breadcrumbs__link">Reference Guides</span><meta itemprop="position" content="1"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/best-practices"><span itemprop="name">Best Practices</span></a><meta itemprop="position" content="2"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item"><a class="breadcrumbs__link" itemprop="item" href="/pages-for-subheaders/rancher-managed-clusters"><span itemprop="name">Rancher-Managed Clusters</span></a><meta itemprop="position" content="3"></li><li itemscope="" itemprop="itemListElement" itemtype="https://schema.org/ListItem" class="breadcrumbs__item breadcrumbs__item--active"><span class="breadcrumbs__link" itemprop="name">Logging Best Practices</span><meta itemprop="position" content="4"></li></ul></nav><span class="theme-doc-version-badge badge badge--secondary">Version: v2.7</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_aoJ5"><button type="button" class="clean-btn tocCollapsibleButton_TO0P">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Logging Best Practices</h1></header><p>In this guide, we recommend best practices for cluster-level logging and application logging.</p><ul><li><a href="#cluster-level-logging">Cluster-level Logging</a></li><li><a href="#application-logging">Application Logging</a></li><li><a href="#general-best-practices">General Best Practices</a></li></ul><p>Before Rancher v2.5, logging in Rancher has historically been a pretty static integration. There were a fixed list of aggregators to choose from (ElasticSearch, Splunk, Kafka, Fluentd and Syslog), and only two configuration points to choose (Cluster-level and Project-level).</p><p>Rancher provides a flexible experience for log aggregation. With the logging feature, administrators and users alike can deploy logging that meets fine-grained collection criteria while offering a wider array of destinations and configuration options.</p><p>&quot;Under the hood&quot;, Rancher logging uses the Banzai Cloud logging operator. We provide manageability of this operator (and its resources), and tie that experience in with managing your Rancher clusters.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="cluster-level-logging">Cluster-level Logging<a class="hash-link" href="#cluster-level-logging" title="Direct link to heading">​</a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="cluster-wide-scraping">Cluster-wide Scraping<a class="hash-link" href="#cluster-wide-scraping" title="Direct link to heading">​</a></h3><p>For some users, it is desirable to scrape logs from every container running in the cluster. This usually coincides with your security team&#x27;s request (or requirement) to collect all logs from all points of execution.</p><p>In this scenario, it is recommended to create at least two <em>ClusterOutput</em> objects - one for your security team (if you have that requirement), and one for yourselves, the cluster administrators. When creating these objects take care to choose an output endpoint that can handle the significant log traffic coming from the entire cluster. Also make sure to choose an appropriate index to receive all these logs.</p><p>Once you have created these <em>ClusterOutput</em> objects, create a <em>ClusterFlow</em> to collect all the logs. Do not define any <em>Include</em> or <em>Exclude</em> rules on this flow. This will ensure that all logs from across the cluster are collected. If you have two <em>ClusterOutputs</em>, make sure to send logs to both of them.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="kubernetes-components">Kubernetes Components<a class="hash-link" href="#kubernetes-components" title="Direct link to heading">​</a></h3><p><em>ClusterFlows</em> have the ability to collect logs from all containers on all hosts in the Kubernetes cluster. This works well in cases where those containers are part of a Kubernetes pod; however, RKE containers exist outside of the scope of Kubernetes.</p><p>Currently the logs from RKE containers are collected, but are not able to easily be filtered. This is because those logs do not contain information as to the source container (e.g. <code>etcd</code> or <code>kube-apiserver</code>).</p><p>A future release of Rancher will include the source container name which will enable filtering of these component logs. Once that change is made, you will be able to customize a <em>ClusterFlow</em> to retrieve <strong>only</strong> the Kubernetes component logs, and direct them to an appropriate output.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="application-logging">Application Logging<a class="hash-link" href="#application-logging" title="Direct link to heading">​</a></h2><p>Best practice not only in Kubernetes but in all container-based applications is to direct application logs to <code>stdout</code>/<code>stderr</code>. The container runtime will then trap these logs and do <strong>something</strong> with them - typically writing them to a file. Depending on the container runtime (and its configuration), these logs can end up in any number of locations.</p><p>In the case of writing the logs to a file, Kubernetes helps by creating a <code>/var/log/containers</code> directory on each host. This directory symlinks the log files to their actual destination (which can differ based on configuration or container runtime).</p><p>Rancher logging will read all log entries in <code>/var/log/containers</code>, ensuring that all log entries from all containers (assuming a default configuration) will have the opportunity to be collected and processed.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="specific-log-files">Specific Log Files<a class="hash-link" href="#specific-log-files" title="Direct link to heading">​</a></h3><p>Log collection only retrieves <code>stdout</code>/<code>stderr</code> logs from pods in Kubernetes. But what if we want to collect logs from other files that are generated by applications? Here, a log streaming sidecar (or two) may come in handy.</p><p>The goal of setting up a streaming sidecar is to take log files that are written to disk, and have their contents streamed to <code>stdout</code>. This way, the Banzai Logging Operator can pick up those logs and send them to your desired output.</p><p>To set this up, edit your workload resource (e.g. Deployment) and add the following sidecar definition:</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">containers</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">args</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">F</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> /path/to/your/log/file.log</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">command</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> tail</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">image</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> busybox</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">name</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> stream</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">log</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">file</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token punctuation" style="color:rgb(199, 146, 234)">[</span><span class="token plain">name</span><span class="token punctuation" style="color:rgb(199, 146, 234)">]</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">volumeMounts</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">mountPath</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> /path/to/your/log</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">name</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"> mounted</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">log</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>This will add a container to your workload definition that will now stream the contents of (in this example) <code>/path/to/your/log/file.log</code> to <code>stdout</code>.</p><p>This log stream is then automatically collected according to any <em>Flows</em> or <em>ClusterFlows</em> you have setup. You may also wish to consider creating a <em>Flow</em> specifically for this log file by targeting the name of the container. See example:</p><div class="language-yaml codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-yaml codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token key atrule">spec</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">match</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> </span><span class="token key atrule">select</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token key atrule">container_names</span><span class="token punctuation" style="color:rgb(199, 146, 234)">:</span><span class="token plain"></span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"> </span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain"> stream</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">log</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">file</span><span class="token punctuation" style="color:rgb(199, 146, 234)">-</span><span class="token plain">name</span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain"></span><span class="token punctuation" style="color:rgb(199, 146, 234)">...</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h2 class="anchor anchorWithStickyNavbar_LWe7" id="general-best-practices">General Best Practices<a class="hash-link" href="#general-best-practices" title="Direct link to heading">​</a></h2><ul><li>Where possible, output structured log entries (e.g. <code>syslog</code>, JSON). This makes handling of the log entry easier as there are already parsers written for these formats.</li><li>Try to provide the name of the application that is creating the log entry, in the entry itself. This can make troubleshooting easier as Kubernetes objects do not always carry the name of the application as the object name. For instance, a pod ID may be something like <code>myapp-098kjhsdf098sdf98</code> which does not provide much information about the application running inside the container.</li><li>Except in the case of collecting all logs cluster-wide, try to scope your <em>Flow</em> and <em>ClusterFlow</em> objects tightly. This makes it easier to troubleshoot when problems arise, and also helps ensure unrelated log entries do not show up in your aggregator. An example of tight scoping would be to constrain a <em>Flow</em> to a single <em>Deployment</em> in a namespace, or perhaps even a single container within a <em>Pod</em>.</li><li>Keep the log verbosity down except when troubleshooting. High log verbosity poses a number of issues, chief among them being <strong>noise</strong>: significant events can be drowned out in a sea of <code>DEBUG</code> messages. This is somewhat mitigated with automated alerting and scripting, but highly verbose logging still places an inordinate amount of stress on the logging infrastructure.</li><li>Where possible, try to provide a transaction or request ID with the log entry. This can make tracing application activity across multiple log sources easier, especially when dealing with distributed applications.</li></ul></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="theme-doc-footer-edit-meta-row row"><div class="col"><a href="https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md" target="_blank" rel="noreferrer noopener" class="theme-edit-this-page"><svg fill="currentColor" height="20" width="20" viewBox="0 0 40 40" class="iconEdit_eYIM" aria-hidden="true"><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"></path></g></svg>Edit this page</a></div><div class="col lastUpdated_vbeJ"><span class="theme-last-updated">Last updated<!-- --> on <b><time datetime="2022-09-23T17:11:24.000Z">9/23/2022</time></b></span></div></div></footer></article><nav class="pagination-nav docusaurus-mt-lg" aria-label="Docs pages navigation"><a class="pagination-nav__link pagination-nav__link--prev" href="/pages-for-subheaders/rancher-managed-clusters"><div class="pagination-nav__sublabel">Previous</div><div class="pagination-nav__label">Best Practices for Rancher Managed Clusters</div></a><a class="pagination-nav__link pagination-nav__link--next" href="/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices"><div class="pagination-nav__sublabel">Next</div><div class="pagination-nav__label">Monitoring Best Practices</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href="#cluster-level-logging" class="table-of-contents__link toc-highlight">Cluster-level Logging</a><ul><li><a href="#cluster-wide-scraping" class="table-of-contents__link toc-highlight">Cluster-wide Scraping</a></li><li><a href="#kubernetes-components" class="table-of-contents__link toc-highlight">Kubernetes Components</a></li></ul></li><li><a href="#application-logging" class="table-of-contents__link toc-highlight">Application Logging</a><ul><li><a href="#specific-log-files" class="table-of-contents__link toc-highlight">Specific Log Files</a></li></ul></li><li><a href="#general-best-practices" class="table-of-contents__link toc-highlight">General Best Practices</a></li></ul></div></div></div></div></main></div></div><footer class="footer footer--dark"><div class="container container-fluid"><div class="footer__bottom text--center"><div class="footer__copyright">Copyright © 2022 SUSE Rancher. All Rights Reserved.</div></div></div></footer></div>
<script src="/assets/js/runtime~main.14fff006.js"></script>
<script src="/assets/js/main.a8ed619c.js"></script>
</body>
</html>