Forward Logs to an External Server

If you did not configure a syslog server when deploying VMware Integrated OpenStack, you can modify your deployment to send logs to a remote syslog server. You can also modify your deployment if you no longer want to send logs to vRealize Log Insight.

The procedure to forward logs to a remote server depends upon your deployment configuration.

If you have never configured a syslog server, you enable the Fluentd Cluster Logging Custom Resource (CR) by creating a custom-fluentd-cr.yml file and using the Kubernetes command-line utility to apply the file.
If you specified a vRealize Log Insight server and want to change the syslog server, you disable fluentd CR using the Kubernetes command-line utility or by removing the vRealize Log Insight IP from the VMware Integrated OpenStack UI. Then you edit the custom-fluentd-cr.yml file and run the file to reenable fluentd CR.

Prerequisites

Verify that a remote syslog server such as Rsyslog is installed and configured.

Procedure

(Optional) If you configured your deployment to send logs to vRealize Log Insight, disable fluentd CR.
- To disable fluentd CR using the VMware Integrated OpenStack UI, remove the IP address that you specified for the vRealize Log Insight syslog server. See Integrate VMware Integrated OpenStack with vRealize Log Insight.
- To disable fluentd CR using the Kubernetes command-line utility, type the command:
```
osctl delete fluentd fluentd1
```

Create the custom-fluentd-cr.yml file with a valid remote syslog server IP and port.

If fluentd CR was previously enabled, you update your existing custom-fluentd-cr.yml file.

apiVersion: vio.vmware.com/v1alpha1
kind: Fluentd
metadata:
  name: fluentd1
  labels:
    app: lcm
    StatusController: ""
spec:
  loginsight:
    type: remote_syslog
    ip: <remote_server_ip>
    port: <remote_server_port>

Enable fluentd CR.
```
osctl apply -f custom-fluentd-cr.yml
```