Best Practices for Collecting Logs in Tanzu Platform for Cloud Foundry
Article ID: 293479
Updated On:
Products
Issue/Introduction
This article explains the best practice for gathering system logs from BOSH virtual machine (VM) while troubleshooting.
Environment
Cause
A "bosh recreate" or "bosh cck" and selecting recreate will destroy the affected VMs and then create a new VM. This process makes existing logs unrecoverable. If you have not configured syslog to deliver your logs to external storage, it is important to extract the logs from a VM before recreating the VM. It is especially important when conducting a root cause analysis.
A "bosh recreate" is executed automatically if the VM resurrection state is ON. This is the default configuration and is set during the Tanzu Platform for Cloud Foundry install. It can be changed on demand using bosh -e my-env update-resurrection on/off.
To prevent losing the VM logs, Pivotal strongly recommends that you configure syslog (BOSH Director and Tanzu Platform for Cloud Foundry) to send your logs to external storage (like Splunk or ELK).
Resolution
Review the following steps/guidelines before executing "bosh recreate" or "bosh cck" on any of your VMs:
- Are your logs being sent to an external Syslog service? If so, your logs should be safe and you can proceed to recreate.
- If logs are NOT being sent to an external Syslog service, please gather logs either from Ops Manager or by running `bosh logs`. You can find instructions here.
- If logs are not able to be captured from the affected VMs, or if you are unable to do that work (perhaps due to time constraints), please note that an RCA will not be possible without logs. By continuing and recreating VMs without obtaining the logs you are effectively declining an RCA.
- If you acknowledge this, proceed to recreate the VMs and indicate this on the ticket. If not, circle back and work on capturing the logs.
Additional Information
Feedback
