Monitoring OpenShift
Forward OpenShift logs, metrics, and events to Splunk.
Stream container logs, metadata-enriched metrics, audit logs, and OpenShift events from any cluster into a Splunk events or metrics index - with dashboards that lead you to what needs fixing, and an Alert Catalog each team scopes to its own clusters and projects. Red Hat–certified images included.
Installation
Set up the Splunk app and HEC, and deploy Collectord
→Concepts
What Collectord does, the data model, and how configuration layers
→Configuration
Deployment files for the standard and RHEL images
→Dashboards
What each page of the app is for, menu by menu
→Annotations
Control index routing, log discovery, and forwarding per pod
→Annotations reference
Full list of every annotation grouped by datatype
→Audit logs
Enable and forward OpenShift audit logs
→Prometheus metrics
Scrape metrics from control plane and applications
→Splunk indexes
Split logs and metrics into separate Splunk indexes
→Metrics index
Send node, pod, container and process stats to a Splunk metrics index
→Splunk field extraction
Define search-time field extraction rules for container logs
→Common Information Model
Map nodes, the API audit, OAuth logins and CPU vulnerabilities to CIM data models
→Splunk HTTP Event Collector
Configure SSL and connection settings for Splunk HEC
→Multiple clusters
Identify and differentiate multiple clusters in Splunk
→Object streaming
Stream live OpenShift object changes to Splunk
→License server
Distribute license keys across clusters from a central URL
→GPU monitoring
Collect NVIDIA GPU metrics with an nvidia-smi DaemonSet
→Alert Catalog
Pick alerts from templates and scope them to clusters and projects
→Troubleshooting
Verify configuration, check pod status, and diagnose issues
→Release history
Changelog of Collectord and Splunk app releases
→Upgrade
Step-by-step version upgrade instructions
→Security
Image security, container privileges, and RBAC access model
→