search

sabre1041 / openshift-logforwarding-splunk

Demonstration of forwarding logs from OpenShift to Splunk
Apache License 2.0
30 stars 26 forks source link

Able to install on OpenShift 4.8. No errors in logforwarding fluent pods as well as fluent pods. No logs transferred to Splunk. #19

Open os-learner opened 2 years ago

os-learner commented 2 years ago

I used values.yaml and modified the following stanzas. Instead of using non-persistent buffers, i used Persistent storage. The pods are running openshift-logforwarding-splunk-0 and openshift-logforwarding-splunk-1. The clusterlogforwarder is created but it didn't restart the fluentd pods. Currently, all are running but no errors to troubleshoot. Need assistance.

sabre1041 commented 2 years ago

@os-learner can you provide any additional details that can be used to aid in assisting?

os-learner commented 2 years ago

@sabre1041 , Sorry for not providing details. One of the things I noticed is, I had my clusterLogging set to "Unmanaged". Once I changed the clusterLogging to "Managed", fluentd pods restarted and now I can see openshift logs in our Enterprise remote splunk instance. Very nicely done. One suggestion: I didn't use the image provided in the helm chart. This image seems old and is not updated by Redhat since 4.6. I used the following image and it is working fine with this image also. registry.redhat.io/openshift-logging/fluentd-rhel8:v1.14.5-3

sunilchinni commented 2 years ago

hi facing same isuue as mentioned help me out