Forwarding OpenShift Container Platform logs to Aria Operations for Logs using Vector Log Collector

Products

• VCF Operations

Issue/Introduction

• Fluentd was formerly utilized as the primary log aggregator for Docker and Kubernetes environments, facilitating integration with VMware Aria Operations for Logs.
  
  
• As per the update from RedHat, Fluentd is deprecated and is planned to be removed in a future release. 
  
  
• Vector is a log collector offered as an alternative to Fluentd for the logging and integrate with Aria Operations for Logs
  
  
• The Aria Operations for Logs release notes includes the deprecation of Fluentd plugin

Environment

Aria Operations for Logs 8.x

Cause

Fluentd deprecation in RedHat OpenShift environments necessitates a transition to the Vector log collector for syslog forwarding.

Resolution

Aria Operations for Logs supports the ingestion of logs from any endpoint capable of sending RFC-compliant syslog data.
Configure the Vector collector within the OpenShift environment to output logs in syslog format.

Also, ensure the Vector output is configured to use the RFC 5424 standard, which is the default for Vector and is fully supported by Aria Operations for Logs.

OpenShift Container Log collection and forwarding