Recommended way to setup log forwarding to papertrail

[Faisal Anwar]

Hi,

I'm trying to integrate logging from our kubernetes clusters to papertrail, but having a difficult time getting a solution that is both reliable and meets our needs. From a requirements perspective, we want the logs to be forwarded via TLS/SSL to papertrail reliably. We've tried using a logspout-based solution that uses the default JSON logs from docker, but that seems to not be reliable. After a few days, we start to see that logs are being dropped. 

Has anyone successfully gotten a syslog/remote_syslog based solution working or some other setup that integrates successfully with papertrail? 

Faisal 

[Rodrigo Ardigó]

Hello,

Let me know if you got a solution. I have the same problem here, would like to send my logs to Papertrail. 

[Iiro Niinikoski]

Hi,

did you find any solution? Would like to hear what happened.

Yours,

Iiro

[Rodrigo Ardigó]

Hello Iiro,

Found a solution while digging around. 

These guys have a log-forwarder container that you can use on kubernetes:

https://github.com/gliderlabs/logspout

And here is a sample config-file that you can deploy on your kubernetes cluster:

apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: logspout
  labels:
    tier: monitoring
    app: logspout
    version: v1
spec:
  template:
    metadata:
      labels:
        name: logspout
    spec:
      hostPID: true
      hostIPC: true
      hostNetwork: true
      containers:
        - resources:
            requests:
              cpu: 0.15
          securityContext:
            privileged: true
          env:
            - name: SYSLOG_TAG
              value: '{{ index .Container.Config.Labels "io.kubernetes.pod.namespace" }}[{{ index .Container.Config.Labels "io.kubernetes.pod.name" }}]'
            - name: SYSLOG_HOSTNAME
              value: 'ENVIRONMENT_PREFIX-{{ index .Container.Config.Labels "io.kubernetes.container.name" }}'
            - name: ROUTE_URIS
              value: syslog+tls://logs.papertrailapp.com:YOUR_PORT
          image: gliderlabs/logspout
          name: logspout
          volumeMounts:
            - name: log
              mountPath: /var/run/docker.sock
      volumes:
        - name: log
          hostPath:
              path: /var/run/docker.sock

Thanks to Mark Marcantano on this thread:
https://github.com/gliderlabs/logspout/issues/90#issuecomment-267134551





Hope that helps! Let us know!

-- 

Rodrigo Ardigó Privacy Officer | Community Team +55(48)9616-3556 rodrigo...@healfies.com SC 401  Km 4 (N. 4150)  - CIA ACATE  (Impact Hub Florianópolis)

--
You received this message because you are subscribed to a topic in the Google Groups "Kubernetes developer/contributor discussion" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/kubernetes-dev/FvtV5_n2mNg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to kubernetes-dev+unsubscribe@googlegroups.com.
To post to this group, send email to kubernetes-dev@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-dev/9d4d0ede-3598-4537-a993-b3141a02a77f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[David Aronchick]

Very cool example!

To post to this group, send email to kuberne...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-dev/9d4d0ede-3598-4537-a993-b3141a02a77f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Kubernetes developer/contributor discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-dev+unsubscribe@googlegroups.com.

To post to this group, send email to kubernetes-dev@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-dev/CAFQoBT6fF2ee_d8rbdmJR6kim63zLi-Z-5Mnf0e0iF481KYHpw%40mail.gmail.com.