Streaming app logs to log management services

Here are instructions for draining logs from Cloud Foundry to a third-party log management service.

Cloud Foundry aggregates logs for all instances of your apps and for requests made to your apps through internal components of Cloud Foundry. For example, when the Cloud Foundry router forwards a request to an app, the router records that event in the log stream for that app. Run the following command to access the log stream for an app in the terminal:

$ cf logs YOUR-APP-NAME

If you want to persist more than the limited amount of logging information that Cloud Foundry can buffer, drain these logs to a log management service.

For more information about the systems responsible for log aggregation and streaming in Cloud Foundry, see App Logging in Cloud Foundry.

Using Services from the Cloud Foundry Marketplace

Your Cloud Foundry marketplace may offer one or more log management services. To use one of these services, create an instance of the service and bind it to your app with the following commands:

$ cf create-service SERVICE PLAN SERVICE-INSTANCE
$ cf bind-service YOUR-APP YOUR-LOG-STORE

For more information about service instance lifecycle management, see Managing Service Instances.

Note Not all marketplace services support syslog drains. Some services implement an integration with Cloud Foundry that enables automated streaming of app syslogs. If you are interested in building services for Ops Manager and making them available to end users, see Services.

Using Services Not Available in Your Marketplace

If a compatible log management service is not available in your Cloud Foundry marketplace, you can use user-provided service instances to stream app logs to a service of your choice. For more information, see the Stream App Logs to a Service section of the User-Provided Service Instances topic.

You may need to prepare your log management service to receive app logs from Cloud Foundry. For specific instructions for several popular services, see Service-Specific Instructions for Streaming App Logs. If you cannot find instructions for your service, follow the generic instructions below.

Step 1: Configure the Log Management Service

To set up a communication channel between the log management service and your Cloud Foundry deployment:

Obtain the external IP addresses that your Ops Manager admin assigns to outbound traffic.
Provide these IP addresses to the log management service. The specific steps to configure a third-party log management service depend on the service.
Add these IP addresses to your allow list to ensure unrestricted log routing to your log management service.
Record the syslog URL provided by the third-party service. Third-party services typically provide a syslog URL to use as an endpoint for incoming log data. You use this syslog URL in Step 2: Create a User-Provided Service Instance.

Cloud Foundry uses the syslog URL to route messages to the service. The syslog URL has a scheme of syslog, syslog-tls, or https, and can include a port number. For example:

syslog://logs.example.com:1234

Note: TAS for VMs does not support using syslog-tls or https with self-signed certificates. If you are running your own syslog server and want to use syslog-tls or https, you must have an SSL certificate signed by a well-known certificate authority.

Important If the URL is an IP address, then it must not contain any leading zeros, for example, 10.0.01.14. If you include the leading zeros, then URL parsing fails.

Step 2: Create and Bind a User-Provided Service Instance

You can create a syslog drain service and bind apps to it using Cloud Foundry Command Line Interface (cf CLI) commands.

To create the service instance, run cf create-user-provided-service (or cf cups) with the -l flag.
```
cf create-user-provided-service DRAIN-NAME -l SYSLOG-URL
```
Where:
- DRAIN-NAME is a name to use for your syslog drain service instance.
- SYSLOG-DRAIN-URL is the syslog URL from Step 1: Configure the Log Management Service.
In case of the usage of the mTLS feature delivered in CAPI release 1.143.0, you can use -p flag to define the credentials, filling in values as follows.
```
cf create-user-provided-service DRAIN-NAME -l SYSLOG-URL -p {"cert":"-----BEGIN CERTIFICATE-----\nMIIH...-----END CERTIFICATE-----","key":"-----BEGIN PRIVATE KEY-----\nMIIE...-----END PRIVATE KEY-----", "ca":"-----BEGIN CERTIFICATE-----\nMIIH...-----END CERTIFICATE-----"}
```
For more information, see User-Provided Service Instances.
To bind an app to the service instance, do one of the following:
- Run cf push with a manifest. The services block in the manifest must specify the service instance that you want to bind.
- Run cf bind-service:
```
cf bind-service YOUR-APP-NAME DRAIN-NAME
```

After a short delay, logs begin to flow automatically.

For more information, see Managing Service Instances with the CLI.

Step 3: Verify Logs Are Draining

To verify that logs are draining correctly to a third-party log management service:

Take actions that produce log messages, such as making requests of your app.
Compare the logs displayed in the CLI against those displayed by the log management service.

For example, if your app serves web pages, you can send HTTP requests to the app. In Cloud Foundry, these generate Router log messages, which you can view in the CLI. Your third-party log management service should display corresponding messages.

Note For security reasons, Cloud Foundry apps do not respond to ping. You cannot use ping to generate log entries.