Accessing logs and metrics for your Tanzu Operations Manager deployment

You can access logs and metrics for VMs and app containers on your VMware Tanzu Operations Manager deployment. It includes information about the available logs and metrics for the VMware Tanzu Application Service for VMs (TAS for VMs) and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) runtimes.

There are different methods for accessing logs and metrics for VMs and app containers depending on if you use the TAS for VMs or TKGI app runtime for your deployment.

There are also different permissions required to access logs and metrics on TAS for VMs and TKGI. The sections in this topic explain how to access logs and metrics on your TAS for VMs or TKGI deployment based on your user role permissions.

Access Platform Director VM logs

Platform Director logs include logs from the Tanzu Operations Manager and BOSH Director VMs.

For both TAS for VMs and TKGI, operators can access platform director VM logs by configuring a syslog drain in the Tanzu Operations Manager tile. For more information, see Settings Page in Using the Tanzu Operations Manager Interface.

The format for the BOSH Director VM logs is Syslog RFC 5424. For more information, see RFC 5424 - The Syslog Protocol in the Internet Engineering Task Force (IETF) documentation.

The format for the Tanzu Operations Manager VM logs is Syslog RFC 3164. For more information, see The BSD Syslog Protocol in the IETF documentation.

Access VM logs

This section describes how to access logs for TAS for VMs and TKGI VMs.

The format for VM logs is Syslog RFC 5424. For more information, see RFC 5424 - The Syslog Protocol in the IETF documentation.

See one of the following sections below:

Access VM Logs on TAS for VMs.
Access VM Logs on TKGI.

Access VM logs on TAS for VMs

TAS for VMs VM logs include logs for runtime component VMs and service tile VMs.

The following table describes how to access VM logs on foundations with TAS for VMs based on user role and permissions:

Title	TAS for VMs Role	Procedure	Notes
Operator	`Admin`	Configure system logging in TAS for VMs. For more information, see Configure System Logging in Configuring TAS for VMs.	To access logs for service instances, you must also configure syslog in each service tile for which you want logs. For more information, see the documentation for the service tile.
Developer	`Space Developer`	Not applicable.

Access VM logs on TKGI

The following table describes how to access VM logs on foundations with TKGI based on user role and permissions:

Title	Role	Procedure	Notes
Operator	`Admin`	Enable system logging in TKGI. For more information, see Host Monitoring in the TKGI installation topic for your IaaS: Installing TKGI on AWS Installing TKGI on Azure Installing TKGI on GCP Installing TKGI on vSphere Installing TKGI on vSphere with NSX-T
Cluster Admin/Developer	Not applicable.	Not applicable.

Access VM metrics

This section describes how to access metrics for TAS for VMs VMs and TKGI VMs.

See one of the following sections below:

Access VM Metrics on TAS for VMs.
Access VM Metrics on TKGI.

Access VM metrics on TAS for VMs

For TAS for VMs deployments, VM metrics include TAS for VMs component and service tile VM metrics.

The following table describes how to access VM metrics on foundations with TAS for VMs based on user role and permissions:

Title	TAS for VMs Role	Procedure	Notes
Operator	`Admin`	No additional configuration is required. TAS for VMs emits VM metrics through the Loggregator Firehose. For more information, see Loggregator Architecture.	The Firehose emits metrics as a gauge or counter Loggregator envelope type. For more information, see the loggregator-api repository on GitHub.
Developer	`Space Developer`	Not allowed.

Access VM metrics on TKGI

For TKGI deployments, VM metrics include metrics for the primary and worker nodes.

VM metrics are available on TKGI v1.5 and later.

The following table describes how to access VM metrics on foundations with TKGI based on user role and permissions.

Title	Role	Procedure	Notes
Operator	`Admin`	Configure an output plug-in in the TKGI tile. For more information, see Creating Sink Resources in the TKGI documentation.	Component VM Metrics include the primary node only.
Cluster Admin	The operator defines the role-based access policy for accessing VM metrics.	Configure a `ClusterMetricSink` in the cluster. For more information, see Creating Sink Resources in the TKGI documentation.	You must configure a `ClusterMetricSink` for each new cluster. Component VM Metrics include the worker nodes only.
Developer	The operator defines the role-based access policy for accessing VM metrics.

Access App Container logs

This section describes how to access app logs on Tanzu Operations Manager.

See one of the following sections below:

Access App Container logs on TAS for VMs.
Access App Container logs on TKGI.

Access App Container logs on TAS for VMs

App container logs for TAS for VMs deployments include logs for apps and service instances.

The following table describes how to access app logs on foundations with TAS for VMs based on user role and permissions.

Title	TAS for VMs Role	Procedure	Notes
Operator	`Admin`	Access logs with one of the following methods: Loggregator Firehose: No configuration required. The Firehose emits logs as text payload. The developer defines the log format. For more information, see the loggregator-api repository on GitHub. Syslog Drain: Requires configuration of Syslog Adapter Drain. For more information, see the TAS for VMs documentation. Aggregate Syslog Drain: A syslog drain that sends all app logs to a single destination. Configure the aggregate syslog drain in the TAS for VMs tile. For more information, see the TAS for VMs documentation.	The Firehose does not emit logs for service instances. To access service instance logs, use the syslog drain or aggregate syslog drain method. Syslog drains emit logs as Syslog RFC 5424.
Developer	`Space Developer`	Access logs with one of the following methods: Loggregator Firehose: The Firehose emits logs as text payload. The developer defines the log format. For more information, see the loggregator-api repository on GitHub. Syslog Drain: Requires configuration of Syslog Adapter Drain. For more information, see the TAS for VMs documentation.	The Firehose does not emit logs for service instances. To access service instance logs, use the syslog drain method. Syslog drains emit logs as Syslog RFC 5424.

Access App Container logs on TKGI

The following table describes how to access app container logs on foundations with TKGI based on user role and permissions:

Title	Role	Procedure	Notes
Operator	`Admin`	Configure a `ClusterSink` in the cluster. For more information, see Creating Sink Resources in the TKGI documentation.	You can send logs from a namespace within a cluster to a log destination by configuring a namespace log `Sink`. For more information, see Creating Sink Resources in the TKGI documentation. You must configure a `ClusterSink` for each new cluster.
Cluster Admin	The operator defines the role-based access policy for accessing app logs.	Configure a `ClusterSink` in the cluster. For more information, see Creating Sink Resources in the TKGI documentation.	You can send logs from a namespace within a cluster to a log destination by configuring a namespace log `Sink`. For more information, see Creating Sink Resources in the TKGI documentation. You must configure a `ClusterSink` for each new cluster.
Developer	The operator defines the role-based access policy for accessing app logs.	Configure a `Sink` in the TKGI tile for a cluster namespace. For more information, see Creating Sink Resources in the TKGI documentation.	You can send logs from a namespace within a cluster to a log destination by configuring a namespace log `Sink`. For more information, see Creating Sink Resources in the TKGI documentation. You must configure a `ClusterSink` for each new cluster. You must provide your own access policy. Developers may not have permissions to configure a `ClusterSink`. Operators must define an access policy that allows developers to create a `ClusterSink`.

Access App Container metrics

This section describes how to access app container metrics on Tanzu Operations Manager.

See one of the following sections below:

Access App Container metrics on TAS for VMs.
Access App Container metrics on TKGI.

Access App Container Metrics on TAS for VMs

App container metrics on TAS for VMs include app metrics and service instance metrics. App container metrics on TAS for VMs do not include task metrics. This is because Diego does not emit task metrics.

The following table describes how to access app container metrics on foundations with TAS for VMs based on user role and permissions:

Title	TAS for VMs Role	Procedure	Notes
Operator	`Admin`	Access metrics with one of the following methods: Loggregator Firehose: No configuration required. Syslog Drain: Requires configuration of Syslog Adapter Drain. For more information, see Step 2: Create and Bind a User-Provided Service Instance in Streaming App Logs to Log Management Services.	The Firehose emits metrics as a gauge or counter Loggregator envelope type. For more information, see the loggregator-api repository on GitHub. Syslog drains emit logs as Syslog RFC 5424.
Developer	`Space Developer`	Access metrics with one of the following methods: Loggregator Firehose: No configuration required. Syslog Drain: Requires configuration of Syslog Adapter Drain. For more information, see Step 2: Create and Bind a User-Provided Service Instance in Streaming App Logs to Log Management Services.

Access App Container metrics on TKGI

The following table describes how to access app container metrics on foundations with TKGI based on user role and permissions:

Title	Role	Procedure	Notes
Operator	`Admin`	Configure a `ClusterMetricSink` in the cluster. For more information, see Creating Sink Resources in the TKGI documentation.	You must configure a `ClusterMetricSink` for each new cluster. You must provide your own access policy.
Cluster Admin	The operator defines the role-based access policy for accessing app metrics.	Configure a `ClusterMetricSink` in the cluster. For more information, see Creating Sink Resources in the TKGI documentation.	You must configure a `ClusterMetricSink` for each new cluster. `ClusterMetricSink` automatically scrapes an annotated `/metrics` Prometheus endpoint.
Developer	The operator defines the role-based access policy for accessing app metrics.	Configure a `MetricSink` in the TKGI tile for a cluster namespace. For more information, see Creating Sink Resources in the TKGI documentation.	You must configure a `ClusterMetricSink` for each new cluster. `ClusterMetricSink` automatically scrapes an annotated `/metrics` Prometheus endpoint. Developers may not have permissions to configure a `ClusterMetricSink`. Operators must define an access policy that allows developers to create a `ClusterMetricSink`.