On Wed, 4 Apr 2018, Rich Megginson wrote:
On 04/04/2018 05:57 PM, David Lang wrote:
On Wed, 4 Apr 2018, Rich Megginson via rsyslog wrote:
On 04/04/2018 05:22 PM, David Lang wrote:
I'm trying to use mmkubernetes where the docker containers are logging
via journald.
my config is:
module(load="imfile" PollingInterval="10") # provided support for
monitoring alternate log files
module(load="imuxsock") # provides support for local system logging (e.g.
via logger command)
module(load="imklog") # provides kernel logging support (previously
done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
I don't see imjournal here?
module(load="mmkubernetes"
kubernetesurl="http://k8s-master.lc.dc.openx.org:8080";
tls.cacert="/etc/ssl/certs/ca-bundle.crt"
allowunsignedcerts="on"
token="foobar"
annotation_match=[".*"]
filenamerules="rule=:/var/log/containers/"
filenamerules is an array value:
https://github.com/rsyslog/rsyslog/blob/master/contrib/mmkubernetes/mmkubernetes.c#L183
That may be causing the crash.
so there is a doc bug:
http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmkubernetes.html?highlight=kubernetes#filenamerules
Does it work if you use a filenamerules like this:
https://github.com/rsyslog/rsyslog/blob/master/contrib/mmkubernetes/mmkubernetes.c#L78
filenamerules=[":/var/log/containers/%pod_name:char-to:.%.%container_hash:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log",":/var/log/containers/%pod_name:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log"]
still segfaults
module(load="imfile" PollingInterval="10") # provided support for monitoring
alternate log files
module(load="imuxsock") # provides support for local system logging (e.g. via
logger command)
module(load="imklog") # provides kernel logging support (previously done by
rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
module(load="mmkubernetes"
kubernetesurl="http://k8s-master.lc.dc.openx.org:8080";
token="foobar"
annotation_match=[".*"]
filenamerules=[":/var/log/containers/%pod_name:char-to:.%.%container_hash:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:c
har-to:.%.log",":/var/log/containers/%pod_name:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log"]
)
action(type="mmkubernetes")
stop
but the following doesn't (it's not processing logs, so I need to add the
imjournal module)
module(load="imfile" PollingInterval="10") # provided support for monitoring
alternate log files
module(load="imuxsock") # provides support for local system logging (e.g. via
logger command)
module(load="imklog") # provides kernel logging support (previously done by
rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
module(load="mmkubernetes"
kubernetesurl="http://k8s-master.lc.dc.openx.org:8080";
token="foobar"
annotation_match=[".*"]
filenamerules=":/var/log/containers/%pod_name:char-to:.%.%container_hash:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:c
har-to:.%.log",":/var/log/containers/%pod_name:char-to:_%_%namespace_name:char-to:_%_%container_name:char-to:-%-%container_id:char-to:.%.log"
)
action(type="mmkubernetes")
stop
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
