284 # The general configuration is used for all deployments
285 #
286 # Run collectord with the flag -conf and specify location of the configuration files.
287 #
288 # You can override all the values using environment variables with the format like
289 # COLLECTOR__<ANYNAME>=<section>__<key>=<value>
290 # As an example you can set dataPath in [general] section as
291 # COLLECTOR__DATAPATH=general__dataPath=C:\\some\\path\\data.db
292 # This parameter can be configured using -env-override, set it to empty string to disable this feature
293
294 [general]
295
296 # Please review license https://www.outcoldsolutions.com/legal/license-agreement/
297 # and accept license by changing the value to *true*
298 acceptLicense = false
299
300 # Location for the database
301 # Collectord stores positions of the files and internal state
302 dataPath = ./data/
303
304 # log level (accepted values are trace, debug, info, warn, error, fatal)
305 logLevel = info
306
307 # Internal http server - serves the liveness (/healthz) and readiness (/readyz)
308 # probes. DaemonSets run on the host network, so bind to loopback (127.0.0.1:11888)
309 # to keep the endpoints off the node IP; the kubelet still reaches them via
310 # httpGet.host 127.0.0.1. The addon runs off the host network and overrides the
311 # bind to 0.0.0.0 in 004-addon.conf so the kubelet can reach it on the pod IP.
312 # httpServerBinding = 0.0.0.0:11888
313 httpServerBinding = 127.0.0.1:11888
314 httpServerEndpoints.health = true
315 httpServerEndpoints.ready = true
316 httpServerEndpoints.metrics = false
317 httpServerEndpoints.pprof = false
318
319 httpServerLog = false
320
321 # telemetry report endpoint, set it to empty string to disable telemetry
322 telemetryEndpoint = https://license.outcold.solutions/telemetry/
323
324 licenseEndpoint = https://license.outcold.solutions/license/
325
326 # Only for the Outcold Solutions License Server; one on-premises uses [license.client]
327 licenseServerProxyUrl =
328
329 # user:password
330 licenseServerProxyBasicAuth =
331
332 license =
333
334 # Environment variable $KUBERNETES_NODENAME is used by default to setup hostname
335 # Use value below to override specific name
336 hostname =
337
338 # Default output for events, logs and metrics
339 # valid values: splunk and devnull
340 # Use devnull by default if you don't want to redirect data
341 defaultOutput = splunk
342
343 # The index type of every input that sets no indexType: events, metrics (a Splunk metrics
344 # index; set [output.splunk] defaultMetricsIndex) or both, to compare the dashboards
345 defaultIndexType = events
346
347 fileInputBufferSize = 8kb
348
349 fileInputLineMaxSize = 1mb
350
351 # Include custom fields to attach to every event, in example below every event sent to Splunk will hav
352 # indexed field my_environment=dev. Fields names should match to ^[a-z][_a-z0-9]*$
353 # Better way to configure that is to specify labels for Kubernetes Nodes.
354 # ; fields.my_environment = dev
355 # Identify the cluster if you are planning to monitor multiple clusters
356 fields.openshift_cluster = -
357
358 # Include EC2 Metadata (see list of possible fields https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)
359 # Should be in format ec2Metadata.{desired_field_name} = {url path to read the value}
360 # ec2Metadata.ec2_instance_id = /latest/meta-data/instance-id
361 # ec2Metadata.ec2_instance_type = /latest/meta-data/instance-type
362
363 # subdomain for the annotations added to the pods, workloads, namespaces or containers, like splunk.collectord.io/..
364 annotationsSubdomain =
365
366 # configure global thruput per second for forwarded logs (metrics are not included)
367 # for example if you set `thruputPerSecond = 512Kb`, that will limit amount of logs forwarded
368 # from the single Collectord instance to 512Kb per second.
369 # You can configure thruput individually for the logs (including specific for container logs) below
370 thruputPerSecond =
371
372 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
373 # older than 7 days
374 tooOldEvents =
375
376 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
377 tooNewEvents =
378
379 # How Collectord spells the fields it composes: "_" (openshift_pod_name, the default) or "."
380 fieldsSeparator =
381
382 # For input.files::X and application logs, when glob or match are configured, Collectord can automatically
383 # detect gzipped files and skip them (based on the extensions or magic numbers)
384 autoSkipGzipFiles = true
385
386 # Publish to non-default outputs asynchronously (default), so a slow or down output does not
387 # block the others; false holds the pipeline back instead of dropping events.
388 multioutput.async = true
389
390 # Buffer size for the async proxy (default 100), per output of each pipeline. When it and
391 # the output's queue are full, events are dropped (multioutput_dropped_events).
392 multioutput.asyncBufferSize = 100
393
394 [license.client]
395 # point to the license located on the HTTP web server, or a hosted by the Collectord running as license server
396 url =
397 basicAuth =
398 insecure = false
399 capath =
400 caname =
401 proxyUrl =
402
403 # user:password
404 proxyBasicAuth =
405
406 [input.collectord_metrics]
407
408 disabled = false
409
410 type = openshift_prometheus
411
412 interval = 1m
413
414 output =
415
416 index =
417
418 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
419 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
420 # metricsOutput: an output whose HEC token can write to the metrics index.
421 metricsIndex =
422 metricsOutput =
423
424 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
425 whitelist.1 = ^file_input_open$
426 whitelist.2 = ^file_input_read_bytes$
427 whitelist.3 = ^openshift_handlers$
428 whitelist.4 = ^pipe$
429 whitelist.5 = ^pipelines_num$
430 whitelist.6 = ^splunk_post_bytes_sum.*$
431 whitelist.7 = ^splunk_post_events_count_sum.*$
432 whitelist.8 = ^splunk_post_failed_requests$
433 whitelist.9 = ^splunk_post_message_max_lag_seconds_bucket.*$
434 whitelist.10 = ^splunk_post_requests_seconds_sum.*$
435 whitelist.11 = ^splunk_post_retries_required_sum.*$
436
437 [general.kubernetes]
438
439 # Override service URL for Kubernetes (default is ${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT})
440 serviceURL =
441
442 # Environment variable $KUBERNETES_NODENAME is used by default to setup nodeName
443 # Use it only when you need to override it
444 nodeName =
445
446 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
447 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
448
449 # Default timeout for http responses. The streaming/watch requests depend on this timeout.
450 timeout = 30m
451
452 # How long to keep the cache for the recent calls to API server (to limit number of calls when collectord discovers new pods)
453 metadataTTL = 30s
454
455 podsCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?$
456
457 containersCgroupFilter = ^/([^/\s]+/)*kubepods(\.slice)?/((kubepods-)?(burstable|besteffort)(\.slice)?/)?([^/]*)pod([0-9a-f]{32}|[0-9a-f\-_]{36})(\.slice)?/(docker-|crio-|cri-\w+-)?[0-9a-f]{64}(\.scope)?(\/.+)?$
458
459 # path to the kubelet root location (use it to discover application logs for emptyDir)
460 # the expected format is `pods/{pod-id}/volumes/kubernetes.io~empty-dir/{volume-name}/_data/`
461 volumesRootDir = /rootfs/var/lib/kubelet/
462
463 # You can attach annotations as a metadata, using the format
464 # includeAnnotations.{key} = {regexp}
465 # For example if you want to include all annotations that starts with `prometheus.io` or `example.com` you can include
466 # the following format:
467 # includeAnnotations.1 = ^prometheus\.io.*
468 # includeAnnotations.2 = ^example\.com.*
469
470 # You can exclude labels from metadata, using the format
471 # excludeLabels.{key} = {regexp}
472 # For example if you want to exclude all labels that starts with `prometheus.io` or `example.com` you can include
473 # the following format:
474 # excludeLabels.1 = ^prometheus\.io.*
475 # excludeLabels.2 = ^example\.com.*
476
477 # watch for changes (annotations) in the objects
478 watch.namespace = v1/namespace
479 watch.deployment = apps/v1/deployment
480 watch.configuration = collectord.io/v1/configuration
481
482 # true lets an annotation name a SplunkOutput of another namespace (splunk::user/<namespace>/<name>),
483 # sending the annotated pod's data with that namespace's HEC token into its indexes
484 crossNamespaceUserOutputs = false
485
486 # Collectord can review the assigned ClusterRole and traverse metadata for the Pods only for the Owner objects
487 # that are defined in the ClusterRole, ignoring anything else, it does not have access to.
488 # This way Collectord does not generate 403 requests on API Server
489 clusterRole = collectorforopenshift
490
491 # Alternative of telling Collectord about the ClusterRole is to manually list the objects.
492 # You can define which objects Collectord should traverse when it sees Owners.
493 ; traverseOwnership.namespaces = v1/namespace
494
495 # watch for pods annotations, setup prometheus collection
496 # for these pods
497 # Addon listens on Pod Network
498 # DaemonSets listen on Host Network
499 [input.prometheus_auto]
500
501 disabled = false
502
503 type = openshift_prometheus
504
505 index =
506
507 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
508 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
509 # metricsOutput: an output whose HEC token can write to the metrics index.
510 metricsIndex =
511 metricsOutput =
512
513 interval = 60s
514
515 includeHelp = true
516
517 timeout = 30s
518
519 output =
520
521 # Include an Authorization header for the prometheus scrapper
522 # When configuring scrapping with collectord using annotations use prometheus.1-AuthorizationKey=key1
523 # authorization.key1 = Bearer FOO
524
525 [output.splunk]
526
527 url =
528
529 # Specify how URL should be picked up (in case if multiple is used)
530 # urlSelection = random|round-robin|random-with-round-robin
531 # where:
532 # * random - choose random url on first selection and a different random one after each failure (connection or HTTP status code >= 500)
533 # * round-robin - choose url starting from first one and bump on each failure (connection or HTTP status code >= 500)
534 # * random-with-round-robin - choose random url on first selection and after that in round-robin on each
535 # failure (connection or HTTP status code >= 500)
536 # With round-robin and random-with-round-robin, the instances on a failed url can all move to the same next one.
537 urlSelection = random
538 token =
539 insecure = false
540 caPath =
541 caName =
542 clientCertPath =
543 clientKeyPath =
544
545 # Events are batched with the maximum size set by batchSize and staying in pipeline for not longer
546 # than set by frequency
547 frequency = 5s
548 batchSize = 768K
549
550 # limit by the number of events (0 value has no limit on the number of events)
551 events = 50
552 proxyUrl =
553
554 # user:password
555 proxyBasicAuth =
556
557 # Splunk acknowledgement url (.../services/collector/ack)
558 ackUrl =
559 ackEnabled = false
560 ackTimeout = 3m
561
562 # Timeout specifies a time limit for requests made by collectord.
563 # The timeout includes connection time, any
564 # redirects, and reading the response body.
565 timeout = 30s
566 idleConnTimeout = 5m
567
568 # in case when pipeline can post to multiple indexes, we want to avoid posibility of blocking
569 # all pipelines, because just some events have incorrect index
570 dedicatedClientPerIndex = true
571
572 # possible values: RedirectToDefault, Drop, Retry
573 incorrectIndexBehavior = RedirectToDefault
574
575 # gzip compression level (nocompression, default, 1...9)
576 compressionLevel = default
577
578 # number of dedicated splunk output threads (to increase throughput above 4k events per second)
579 threads = 2
580
581 # Default algorithm between threads is roundrobin, but you can change it to weighted
582 ; threadsAlgorithm = weighted
583 threadsAlgorithm = weighted
584
585 # For the move to fieldsSeparator = ".": send every built-in field a second time under its
586 # underscore name (events only). A named output inherits the default output's value.
587 ; duplicateFieldsWithUnderscore = true
588 duplicateFieldsWithUnderscore = false
589
590 # By default if there are no indexes defined on the message, Collectord sends the event without the index, and
591 # Splunk HTTP Event Collector going to use the default index for the Token. You can change that, and tell Collectord
592 # to ignore all events that don't have index defined explicitly
593 ; requireExplicitIndex = true
594 requireExplicitIndex = false
595
596 # Splunk metrics index for the metrics-index records (indexType = metrics or both) of every
597 # input that names no metricsIndex; unset, they land in the HEC token's default index
598 ; defaultMetricsIndex = openshift_metrics
599 defaultMetricsIndex =
600
601 # For messages generated from logs, include unique `event_id` in the event
602 ; includeEventID = false
603 includeEventID = false
604
605 # Dedicated queue size for the output, default is 1024, larger queue sizes will require more memory,
606 # but will allow to handle more events in case of network issues
607 queueSize = 1024
609 [general.cri-o]
610
611 # url for CRIO API, only unix socket is supported
612 url = unix:///rootfs/var/run/crio/crio.sock
613
614 # Timeout for http responses to docker client. The streaming requests depend on this timeout.
615 timeout = 1m
616
617 [input.system_stats]
618
619 disabled.host = false
620 disabled.cgroup = false
621
622 pathCgroups = /rootfs/sys/fs/cgroup
623
624 pathProc = /rootfs/proc
625
626 statsInterval = 30s
627
628 type.host = openshift_stats_v2_host
629 type.cgroup = openshift_stats_v2_cgroup
630
631 index.host =
632 index.cgroup =
633
634 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
635 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
636 # metricsOutput: an output whose HEC token can write to the metrics index.
637 metricsIndex.host =
638 metricsIndex.cgroup =
639 metricsOutput.host =
640 metricsOutput.cgroup =
641
642 output.host =
643 output.cgroup =
644
645 [input.proc_stats]
646
647 disabled = false
648
649 pathProc = /rootfs/proc
650
651 statsInterval = 30s
652
653 type = openshift_proc_stats_v2
654
655 index.host =
656 index.cgroup =
657
658 # proc filesystem includes by default system threads (there can be over 100 of them)
659 # these stats do not help with the observability
660 # excluding them can reduce the size of the index, performance of the searches and usage of the collector
661 includeSystemThreads = false
662
663 output.host =
664 output.cgroup =
665
666 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
667 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
668 # metricsOutput: an output whose HEC token can write to the metrics index.
669 metricsIndex =
670 metricsOutput =
671
672 # Hide arguments for the processes, replacing with HIDDEN_ARGS(NUMBER)
673 hideArgs = false
674
675 [input.net_stats]
676
677 disabled = false
678
679 pathProc = /rootfs/proc
680
681 statsInterval = 30s
682
683 type = openshift_net_stats_v2
684
685 index.host =
686 index.cgroup =
687
688 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
689 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
690 # metricsOutput: an output whose HEC token can write to the metrics index.
691 metricsIndex.host =
692 metricsIndex.cgroup =
693 metricsOutput.host =
694 metricsOutput.cgroup =
695
696 output.host =
697 output.cgroup =
698
699 [input.net_socket_table]
700
701 disabled = false
702
703 pathProc = /rootfs/proc
704
705 statsInterval = 30s
706
707 type = openshift_net_socket_table
708
709 index.host =
710 index.cgroup =
711
712 output.host =
713 output.cgroup =
714
715 # group connections by tcp_state, localAddr, remoteAddr (if localPort is not the port it is listening on)
716 # that can significally reduces the amount of events
717 group = true
718
719 # Collectord can watch for services, node, and pod IP addresses, and lookup the names
720 # for the IP addresses. Keeping this enabled can add a significant load on the API Server, with large number of pods.
721 disableLookup = false
722
723 [input.mount_stats]
724
725 disabled = false
726
727 statsInterval = 30s
728
729 # root: the filesystem of the kubelet's root directory; auto: every real filesystem, one event each
730 mounts = root
731
732 # with mounts = auto: a regular expression the filesystem type must match, and one the
733 # mount point must not (empty: the defaults)
734 include =
735 exclude =
736
737 type = openshift_mount_stats
738
739 index =
740
741 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
742 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
743 # metricsOutput: an output whose HEC token can write to the metrics index.
744 metricsIndex =
745 metricsOutput =
746
747 output =
748
749 [input.disk_stats]
750
751 disabled = false
752
753 statsInterval = 30s
754
755 type = openshift_disk_stats
756
757 index =
758
759 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
760 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
761 # metricsOutput: an output whose HEC token can write to the metrics index.
762 metricsIndex =
763 metricsOutput =
764
765 output =
766
767 [input.files]
768
769 disabled = false
770
771 # root location of docker log files
772 # logs are expected in standard docker format like {containerID}/{containerID}-json.log
773 # rotated files
774 path = /rootfs/var/lib/docker/containers/
775
776 # root location of CRI-O files
777 # logs are expected in Kubernetes format, like {podID}/{containerName}/0.log
778 crioPath = /rootfs/var/log/pods/
779
780 # files are read using polling schema, when reach the EOF how often to check if files got updated
781 pollingInterval = 250ms
782
783 # how often to look for the new files under logs path
784 walkingInterval = 5s
785
786 # include verbose fields in events (file offset)
787 verboseFields = false
788
789 type = openshift_logs
790
791 index =
792
793 # docker splits events when they are larger than 10-100k (depends on the docker version)
794 # we join them together by default and forward to Splunk as one event
795 joinPartialEvents = true
796
797 # In case if your containers report messages with terminal colors or other escape sequences
798 # you can enable strip for all the containers in one place.
799 # Better is to enable it only for required container with the annotation collectord.io/logs-escapeterminalsequences=true
800 stripTerminalEscapeSequences = false
801
802 # Regexp used for stripping terminal colors, it does not stip all the escape sequences
803 # Read http://man7.org/linux/man-pages/man4/console_codes.4.html for more information
804 stripTerminalEscapeSequencesRegex = (\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)
805
806 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
807 samplingPercent = -1
808
809 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
810 samplingKey =
811
812 output =
813
814 # configure default thruput per second for for each container log
815 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
816 # from the single container to 128Kb per second.
817 thruputPerSecond =
818
819 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
820 # older than 7 days
821 tooOldEvents =
822
823 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
824 tooNewEvents =
825
826 # Read rotated logs the kubelet compressed before Collectord read them; false counts them lost
827 readCompressed = true
828
829 # Bytes of those logs inflated at once, node-wide, under [general] dataPath
830 compressedInflateBudget = 256MiB
831
832 # Group each stream's repeated lines into one event per run that counts them.
833 # Off unless true; a workload overrides it with its
834 # collectord.io/logs-repeat-enabled annotation.
835 repeatEnabled = false
836
837 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
838 # repeatMaxSpan = 1m
839
840 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
841 # repeatOffsets = false
842
843 # What each stream may remember: distinct lines, lines one event stands for, and bytes
844 # repeatMaxKeys = 256
845 # repeatMaxCount = 1000
846 # repeatMaxBytes = 256KB
847
848 # Fold each stream's lines of one pattern past foldMaxPerMinute into one summary a minute.
849 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
850 # collectord.io/logs-fold-enabled annotation.
851 foldEnabled = false
852
853 # Lines of one pattern a minute sent before the rest fold
854 # foldMaxPerMinute = 60
855
856 # Lines never folded (a regular expression; empty: the default)
857 # foldKeep = (?i)error|exception|fatal|panic
858
859 # What each stream may keep a minute: its patterns and summaries
860 # foldMaxBytes = 256KB
861
862 # Report each stream's top patterns every interval, as events of their own.
863 # Off unless true; a workload overrides it with its
864 # collectord.io/logs-patterns-enabled annotation.
865 patternsEnabled = false
866
867 # How often a report goes out, from 1m to 24h
868 # patternsInterval = 15m
869
870 # How many patterns a report carries, up to 100
871 # patternsTop = 20
872
873 # What each stream's patterns may keep; past it a new one takes the place of the lightest
874 # patternsMaxBytes = 256KB
875
876 # The report events' type (empty: the input's type with _patterns after it)
877 # patternsType =
878
879 [input.app_logs]
880
881 disabled = false
882
883 # root location of mounts (applies to hostPath mounts only), if the hostPath differs inside container from the path on host
884 root = /rootfs/
885
886 # how often to review list of available volumes
887 syncInterval = 5s
888
889 glob = *.log*
890
891 # files are read using polling schema, when reach the EOF how often to check if files got updated
892 pollingInterval = 250ms
893
894 # how often to look for the new files under logs path
895 walkingInterval = 5s
896
897 # include verbose fields in events (file offset)
898 verboseFields = false
899
900 type = openshift_logs
901
902 index =
903
904 # we split files using new line character, with this configuration you can specify what defines the new event
905 # after new line
906 eventPatternRegex = ^[^\s]
907 eventPatternMaxInterval = 100ms
908 eventPatternMaxWait = 1s
909 eventPatternMaxSize = 1MB
910
911 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
912 samplingPercent = -1
913
914 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
915 samplingKey =
916
917 output =
918
919 # configure default thruput per second for for each container log
920 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
921 # from the single container to 128Kb per second.
922 thruputPerSecond =
923
924 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
925 # older than 7 days
926 tooOldEvents =
927
928 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
929 tooNewEvents =
930
931 # Configure how long Collectord should keep the file descriptors open for files, that has not been forwarded yet
932 # When using PVC, and if pipeline is lagging behind, Collectord holding open fd for files, can cause long termination
933 # of pods, as kubelet cannot unmount the PVC volume from the system
934 maxHoldAfterClose = 1800s
935
936 # Group each file's repeated lines into one event per run that counts them.
937 # Off unless true; a workload overrides it with its
938 # collectord.io/volume.<n>-logs-repeat-enabled annotation.
939 repeatEnabled = false
940
941 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
942 # repeatMaxSpan = 1m
943
944 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
945 # repeatOffsets = false
946
947 # What each file may remember: distinct lines, lines one event stands for, and bytes
948 # repeatMaxKeys = 256
949 # repeatMaxCount = 1000
950 # repeatMaxBytes = 256KB
951
952 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
953 # Lossy: folded lines are not sent. Off unless true; a workload overrides it with its
954 # collectord.io/volume.<n>-logs-fold-enabled annotation.
955 foldEnabled = false
956
957 # Lines of one pattern a minute sent before the rest fold
958 # foldMaxPerMinute = 60
959
960 # Lines never folded (a regular expression; empty: the default)
961 # foldKeep = (?i)error|exception|fatal|panic
962
963 # What each file may keep a minute: its patterns and summaries
964 # foldMaxBytes = 256KB
965
966 # Report each file's top patterns every interval, as events of their own.
967 # Off unless true; a workload overrides it with its
968 # collectord.io/volume.<n>-logs-patterns-enabled annotation.
969 patternsEnabled = false
970
971 # How often a report goes out, from 1m to 24h
972 # patternsInterval = 15m
973
974 # How many patterns a report carries, up to 100
975 # patternsTop = 20
976
977 # What each file's patterns may keep; past it a new one takes the place of the lightest
978 # patternsMaxBytes = 256KB
979
980 # The report events' type (empty: the input's type with _patterns after it)
981 # patternsType =
982
983 [input.files::audit-logs]
984
985 disabled = false
986
987 path = /rootfs/var/log/kube-apiserver/
988
989 glob = audit*.log
990
991 match =
992
993 # limit search only on one level
994 recursive = false
995 nodeSelector = node-role.kubernetes.io/master
996
997 # files are read using polling schema, when reach the EOF how often to check if files got updated
998 pollingInterval = 250ms
999
1000 # how often o look for the new files under logs path
1001 walkingInterval = 5s
1002
1003 # include verbose fields in events (file offset)
1004 verboseFields = false
1005
1006 type = openshift_host_logs
1007
1008 index =
1009
1010 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1011 extractionMessageField = message
1012
1013 timestampField = timestamp
1014
1015 # format for timestamp
1016 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1017 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1018
1019 # timestamp location (if not defined by format)
1020 timestampLocation =
1021
1022 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1023 samplingPercent = -1
1024
1025 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1026 samplingKey =
1027
1028 output =
1029
1030 # configure default thruput per second for this files group
1031 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1032 # from the files in this group to 128Kb per second.
1033 thruputPerSecond =
1034
1035 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1036 # older than 7 days
1037 tooOldEvents =
1038
1039 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1040 tooNewEvents =
1041
1042 # by default every new event should start from not space symbol
1043 eventPattern =
1044
1045 # Blacklisting and whitelisting the logs
1046 # whitelist.0 = ^regexp$
1047 # blacklist.0 = ^regexp$
1048
1049 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1050 # a spent cap drops the other lines instead of pausing this input
1051 # thruputExempt.0 = ^regexp$
1052
1053 # Group each file's repeated lines into one event per run that counts them.
1054 # Off unless true.
1055 repeatEnabled = false
1056
1057 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1058 # repeatMaxSpan = 1m
1059
1060 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1061 # repeatOffsets = false
1062
1063 # What each file may remember: distinct lines, lines one event stands for, and bytes
1064 # repeatMaxKeys = 256
1065 # repeatMaxCount = 1000
1066 # repeatMaxBytes = 256KB
1067
1068 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1069 # Lossy: folded lines are not sent. Off unless true.
1070 foldEnabled = false
1071
1072 # Lines of one pattern a minute sent before the rest fold
1073 # foldMaxPerMinute = 60
1074
1075 # Lines never folded (a regular expression; empty: the default)
1076 # foldKeep = (?i)error|exception|fatal|panic
1077
1078 # What each file may keep a minute: its patterns and summaries
1079 # foldMaxBytes = 256KB
1080
1081 # Report each file's top patterns every interval, as events of their own.
1082 # Off unless true.
1083 patternsEnabled = false
1084
1085 # How often a report goes out, from 1m to 24h
1086 # patternsInterval = 15m
1087
1088 # How many patterns a report carries, up to 100
1089 # patternsTop = 20
1090
1091 # What each file's patterns may keep; past it a new one takes the place of the lightest
1092 # patternsMaxBytes = 256KB
1093
1094 # The report events' type (empty: the input's type with _patterns after it)
1095 # patternsType =
1096
1097 [input.files::oauth-apiserver-audit-logs]
1098
1099 disabled = false
1100
1101 path = /rootfs/var/log/oauth-apiserver/
1102
1103 glob = audit*.log
1104
1105 match =
1106
1107 # limit search only on one level
1108 recursive = false
1109 nodeSelector = node-role.kubernetes.io/master
1110
1111 # files are read using polling schema, when reach the EOF how often to check if files got updated
1112 pollingInterval = 250ms
1113
1114 # how often o look for the new files under logs path
1115 walkingInterval = 5s
1116
1117 # include verbose fields in events (file offset)
1118 verboseFields = false
1119
1120 type = openshift_host_logs
1121
1122 index =
1123
1124 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1125 extractionMessageField = message
1126
1127 timestampField = timestamp
1128
1129 # format for timestamp
1130 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1131 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1132
1133 # timestamp location (if not defined by format)
1134 timestampLocation =
1135
1136 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1137 samplingPercent = -1
1138
1139 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1140 samplingKey =
1141
1142 output =
1143
1144 # configure default thruput per second for this files group
1145 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1146 # from the files in this group to 128Kb per second.
1147 thruputPerSecond =
1148
1149 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1150 # older than 7 days
1151 tooOldEvents =
1152
1153 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1154 tooNewEvents =
1155
1156 # by default every new event should start from not space symbol
1157 eventPattern =
1158
1159 # Blacklisting and whitelisting the logs
1160 # whitelist.0 = ^regexp$
1161 # blacklist.0 = ^regexp$
1162
1163 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1164 # a spent cap drops the other lines instead of pausing this input
1165 # thruputExempt.0 = ^regexp$
1166
1167 # Group each file's repeated lines into one event per run that counts them.
1168 # Off unless true.
1169 repeatEnabled = false
1170
1171 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1172 # repeatMaxSpan = 1m
1173
1174 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1175 # repeatOffsets = false
1176
1177 # What each file may remember: distinct lines, lines one event stands for, and bytes
1178 # repeatMaxKeys = 256
1179 # repeatMaxCount = 1000
1180 # repeatMaxBytes = 256KB
1181
1182 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1183 # Lossy: folded lines are not sent. Off unless true.
1184 foldEnabled = false
1185
1186 # Lines of one pattern a minute sent before the rest fold
1187 # foldMaxPerMinute = 60
1188
1189 # Lines never folded (a regular expression; empty: the default)
1190 # foldKeep = (?i)error|exception|fatal|panic
1191
1192 # What each file may keep a minute: its patterns and summaries
1193 # foldMaxBytes = 256KB
1194
1195 # Report each file's top patterns every interval, as events of their own.
1196 # Off unless true.
1197 patternsEnabled = false
1198
1199 # How often a report goes out, from 1m to 24h
1200 # patternsInterval = 15m
1201
1202 # How many patterns a report carries, up to 100
1203 # patternsTop = 20
1204
1205 # What each file's patterns may keep; past it a new one takes the place of the lightest
1206 # patternsMaxBytes = 256KB
1207
1208 # The report events' type (empty: the input's type with _patterns after it)
1209 # patternsType =
1210
1211 [input.files::oauth-server-audit-logs]
1212
1213 disabled = false
1214
1215 path = /rootfs/var/log/oauth-server/
1216
1217 glob = audit*.log
1218
1219 match =
1220
1221 # limit search only on one level
1222 recursive = false
1223 nodeSelector = node-role.kubernetes.io/master
1224
1225 # files are read using polling schema, when reach the EOF how often to check if files got updated
1226 pollingInterval = 250ms
1227
1228 # how often o look for the new files under logs path
1229 walkingInterval = 5s
1230
1231 # include verbose fields in events (file offset)
1232 verboseFields = false
1233
1234 type = openshift_host_logs
1235
1236 index =
1237
1238 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1239 extractionMessageField = message
1240
1241 timestampField = timestamp
1242
1243 # format for timestamp
1244 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1245 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1246
1247 # timestamp location (if not defined by format)
1248 timestampLocation =
1249
1250 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1251 samplingPercent = -1
1252
1253 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1254 samplingKey =
1255
1256 output =
1257
1258 # configure default thruput per second for this files group
1259 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1260 # from the files in this group to 128Kb per second.
1261 thruputPerSecond =
1262
1263 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1264 # older than 7 days
1265 tooOldEvents =
1266
1267 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1268 tooNewEvents =
1269
1270 # by default every new event should start from not space symbol
1271 eventPattern =
1272
1273 # Blacklisting and whitelisting the logs
1274 # whitelist.0 = ^regexp$
1275 # blacklist.0 = ^regexp$
1276
1277 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1278 # a spent cap drops the other lines instead of pausing this input
1279 # thruputExempt.0 = ^regexp$
1280
1281 # Group each file's repeated lines into one event per run that counts them.
1282 # Off unless true.
1283 repeatEnabled = false
1284
1285 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1286 # repeatMaxSpan = 1m
1287
1288 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1289 # repeatOffsets = false
1290
1291 # What each file may remember: distinct lines, lines one event stands for, and bytes
1292 # repeatMaxKeys = 256
1293 # repeatMaxCount = 1000
1294 # repeatMaxBytes = 256KB
1295
1296 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1297 # Lossy: folded lines are not sent. Off unless true.
1298 foldEnabled = false
1299
1300 # Lines of one pattern a minute sent before the rest fold
1301 # foldMaxPerMinute = 60
1302
1303 # Lines never folded (a regular expression; empty: the default)
1304 # foldKeep = (?i)error|exception|fatal|panic
1305
1306 # What each file may keep a minute: its patterns and summaries
1307 # foldMaxBytes = 256KB
1308
1309 # Report each file's top patterns every interval, as events of their own.
1310 # Off unless true.
1311 patternsEnabled = false
1312
1313 # How often a report goes out, from 1m to 24h
1314 # patternsInterval = 15m
1315
1316 # How many patterns a report carries, up to 100
1317 # patternsTop = 20
1318
1319 # What each file's patterns may keep; past it a new one takes the place of the lightest
1320 # patternsMaxBytes = 256KB
1321
1322 # The report events' type (empty: the input's type with _patterns after it)
1323 # patternsType =
1324
1325 [input.files::openshift-apiserver-audit-logs]
1326
1327 disabled = false
1328
1329 path = /rootfs/var/log/openshift-apiserver/
1330
1331 glob = audit*.log
1332
1333 match =
1334
1335 # limit search only on one level
1336 recursive = false
1337 nodeSelector = node-role.kubernetes.io/master
1338
1339 # files are read using polling schema, when reach the EOF how often to check if files got updated
1340 pollingInterval = 250ms
1341
1342 # how often o look for the new files under logs path
1343 walkingInterval = 5s
1344
1345 # include verbose fields in events (file offset)
1346 verboseFields = false
1347
1348 type = openshift_host_logs
1349
1350 index =
1351
1352 extraction = (?P<message>.*"stageTimestamp":"(?P<timestamp>[^"]+)".*)
1353 extractionMessageField = message
1354
1355 timestampField = timestamp
1356
1357 # format for timestamp
1358 # the layout defines the format by showing how the reference time, defined to be `Mon Jan 2 15:04:05 -0700 MST 2006`
1359 timestampFormat = 2006-01-02T15:04:05.999999999Z07:00
1360
1361 # timestamp location (if not defined by format)
1362 timestampLocation =
1363
1364 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1365 samplingPercent = -1
1366
1367 # sampling key for hash based sampling (should be regexp with the named match pattern `key`)
1368 samplingKey =
1369
1370 output =
1371
1372 # configure default thruput per second for this files group
1373 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1374 # from the files in this group to 128Kb per second.
1375 thruputPerSecond =
1376
1377 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1378 # older than 7 days
1379 tooOldEvents =
1380
1381 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1382 tooNewEvents =
1383
1384 # by default every new event should start from not space symbol
1385 eventPattern =
1386
1387 # Blacklisting and whitelisting the logs
1388 # whitelist.0 = ^regexp$
1389 # blacklist.0 = ^regexp$
1390
1391 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1392 # a spent cap drops the other lines instead of pausing this input
1393 # thruputExempt.0 = ^regexp$
1394
1395 # Group each file's repeated lines into one event per run that counts them.
1396 # Off unless true.
1397 repeatEnabled = false
1398
1399 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1400 # repeatMaxSpan = 1m
1401
1402 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1403 # repeatOffsets = false
1404
1405 # What each file may remember: distinct lines, lines one event stands for, and bytes
1406 # repeatMaxKeys = 256
1407 # repeatMaxCount = 1000
1408 # repeatMaxBytes = 256KB
1409
1410 # Fold each file's lines of one pattern past foldMaxPerMinute into one summary a minute.
1411 # Lossy: folded lines are not sent. Off unless true.
1412 foldEnabled = false
1413
1414 # Lines of one pattern a minute sent before the rest fold
1415 # foldMaxPerMinute = 60
1416
1417 # Lines never folded (a regular expression; empty: the default)
1418 # foldKeep = (?i)error|exception|fatal|panic
1419
1420 # What each file may keep a minute: its patterns and summaries
1421 # foldMaxBytes = 256KB
1422
1423 # Report each file's top patterns every interval, as events of their own.
1424 # Off unless true.
1425 patternsEnabled = false
1426
1427 # How often a report goes out, from 1m to 24h
1428 # patternsInterval = 15m
1429
1430 # How many patterns a report carries, up to 100
1431 # patternsTop = 20
1432
1433 # What each file's patterns may keep; past it a new one takes the place of the lightest
1434 # patternsMaxBytes = 256KB
1435
1436 # The report events' type (empty: the input's type with _patterns after it)
1437 # patternsType =
1438
1439 [input.journald]
1440
1441 disabled = false
1442
1443 path.persistent = /rootfs/var/log/journal/
1444
1445 # when reach end of journald, how often to pull
1446 pollingInterval = 250ms
1447
1448 # if you don't want to forward journald from the beginning,
1449 # set the oldest event in relative value, like -14h or -30m or -30s (h/m/s supported)
1450 startFromRel =
1451
1452 type = openshift_host_logs
1453
1454 index =
1455
1456 # sample output (-1 does not sample, 20 - only 20% of the logs should be forwarded)
1457 samplingPercent = -1
1458
1459 # sampling key (should be regexp with the named match pattern `key`)
1460 samplingKey =
1461
1462 # how often to reopen the journald to free old files
1463 reopenInterval = 1h
1464
1465 output =
1466
1467 # configure default thruput per second for journald
1468 # for example if you set `thruputPerSecond = 128Kb`, that will limit amount of logs forwarded
1469 # from the journald to 128Kb per second.
1470 thruputPerSecond =
1471
1472 # Configure events that are too old to be forwarded, for example 168h (7 days) - that will drop all events
1473 # older than 7 days
1474 tooOldEvents =
1475
1476 # Configure events that are too new to be forwarded, for example 1h - that will drop all events that are 1h in future
1477 tooNewEvents =
1478
1479 # by default every new event should start from not space symbol
1480 eventPattern = ^[^\s]
1481
1482 # By default ignoring verbose hyperkube logs (all INFO messages)
1483 blacklist.1 = ^I\d+.*$
1484
1485 # Lines matching a thruputExempt pattern pass every thruput cap and sampling; with one set,
1486 # a spent cap drops the other lines instead of pausing journald
1487
1488 # Move Journald logs reader to a separate process, to prevent process from crashing in case of corrupted log files
1489 spawnExternalProcess = false
1490
1491 # Group each writer's repeated lines into one event per run that counts them.
1492 # Off unless true.
1493 # A writer is a unit, identifier, command, process, priority and facility: never grouped with another.
1494 repeatEnabled = false
1495
1496 # How long a run is held before its event goes out, up to 10m (a crash resends up to that much)
1497 # repeatMaxSpan = 1m
1498
1499 # Add every line's time to a run's event (collectord_repeat_offsets, milliseconds from its own)
1500 # repeatOffsets = false
1501
1502 # What the journal, all its writers together, may remember: distinct lines, lines one event stands for, and bytes
1503 # repeatMaxKeys = 256
1504 # repeatMaxCount = 1000
1505 # repeatMaxBytes = 256KB
1506
1507 # Fold each writer's lines of one pattern past foldMaxPerMinute into one summary a minute.
1508 # Lossy: folded lines are not sent. Off unless true.
1509 # A writer is a unit, identifier, command, process, priority and facility: never folded with another.
1510 foldEnabled = false
1511
1512 # Lines of one pattern a minute sent before the rest fold
1513 # foldMaxPerMinute = 60
1514
1515 # Lines never folded (a regular expression; empty: the default)
1516 # foldKeep = (?i)error|exception|fatal|panic
1517
1518 # What the journal, all its writers together, may keep a minute: its patterns and summaries
1519 # foldMaxBytes = 256KB
1520
1521 # Report the journal's top patterns every interval, as events of their own.
1522 # Off unless true.
1523 # A writer is a unit, identifier, command, process, priority and facility: its lines never share a pattern with another's, and the top patterns are of all its writers together.
1524 patternsEnabled = false
1525
1526 # How often a report goes out, from 1m to 24h
1527 # patternsInterval = 15m
1528
1529 # How many patterns a report carries, up to 100
1530 # patternsTop = 20
1531
1532 # What the journal's patterns may keep; past it a new one takes the place of the lightest
1533 # patternsMaxBytes = 256KB
1534
1535 # The report events' type (empty: the input's type with _patterns after it)
1536 # patternsType =
1537
1538 # Pipe to join events (container logs only)
1539 [pipe.join]
1540
1541 disabled = false
1542
1543 maxInterval = 100ms
1544
1545 maxWait = 1s
1546
1547 maxSize = 1MB
1548
1549 # Default pattern to indicate new message (should start not from space)
1550 patternRegex = ^[^\s]
1551
1552 # You can configure global replace rules for the events, which can help to remove sensitive data
1553 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1554 # application logs and events.
1555 # In the following example we replace password=TEST with password=********
1556 ; [pipe.replace::name]
1557 ; patternRegex = (password=)([^\s]+)
1558 ; replace = $1********
1559
1560 # You can configure global hash rules for the events, which can help to hide sensitive data
1561 # from logs before they are sent to outputs. Those rules will be applied to all pipelines for container logs, host logs,
1562 # application logs and events.
1563 # In the following example we hash IP addresses with fnv-1a-64
1564 ; [pipe.hash::name]
1565 ; match = (\d{1,3}\.){3}\d{1,3}'
1566 ; function = fnv-1a-64
1567
1568 # Log lines matching patternRegex pass every thruput cap and sampling, in the workloads whose
1569 # fields match every matchRegex.<field>; over its cap such a workload drops its other lines
1570 # instead of pausing. Select by namespace: pod, container and image names are the workload
1571 # owner's to choose, and label fields never match
1572 ; [pipe.thruput_exempt::payments-audit]
1573 ; matchRegex.openshift_namespace = ^payments$
1574 ; patternRegex = ^AUDIT
1575
1576 # Count the events and bytes leaving every pipeline (pipeline_events, pipeline_bytes);
1577 # maxSeries bounds the label combinations. Fields are written with underscores.
1578 ; [pipe.eventcount]
1579 ; labels = index, sourcetype, output
1580 ; fields = openshift_namespace
1581 ; maxSeries = 1000
1582
1583 [input.prometheus::controller]
1584
1585 disabled = false
1586
1587 type = openshift_prometheus
1588
1589 index =
1590
1591 source = controller
1592
1593 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1594 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1595 # metricsOutput: an output whose HEC token can write to the metrics index.
1596 metricsIndex =
1597 metricsOutput =
1598
1599 # Override host (environment variables are supported)
1600 host = ${KUBERNETES_NODENAME}
1601
1602 source = controller
1603
1604 interval = 60s
1605
1606 timeout = 60s
1607
1608 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1609 # podSelector (with podNamespace): the pods on this node a label selector matches;
1610 # endpoint(s) beside it are the fallback on a node where none runs.
1611 podNamespace = openshift-kube-controller-manager
1612 podSelector = app=kube-controller-manager
1613
1614 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1615
1616 # endpoint.N: literal URLs, the first that answers
1617
1618 endpoint.1 = https://127.0.0.1:10257/metrics
1619
1620 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1621 nodeSelector = node-role.kubernetes.io/master
1622
1623 # === HOW: port (number) or portName, plus scheme and path ===
1624 port = 10257
1625
1626 scheme = https
1627 path = /metrics
1628
1629 # token for "Authorization: Bearer $(cat tokenPath)"
1630 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1631
1632 # server certificate for certificate validation
1633 certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
1634
1635 # the name the server certificate is verified against, when not the address dialed
1636 caName = kube-controller-manager.openshift-kube-controller-manager.svc
1637
1638 clientCertPath =
1639
1640 insecure = false
1641
1642 includeHelp = false
1643
1644 output =
1645
1646 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1647
1648 whitelist.1 = ^(kubernetes|openshift)_build_info$
1649 whitelist.2 = ^node_collector_zone_size$
1650 whitelist.3 = ^node_collector_zone_health$
1651 whitelist.4 = ^node_collector_unhealthy_nodes_in_zone$
1652 whitelist.5 = ^node_collector_evictions_total$
1653 whitelist.6 = ^workqueue_depth$
1654 whitelist.7 = ^workqueue_retries_total$
1655 whitelist.8 = ^workqueue_longest_running_processor_seconds$
1656 whitelist.9 = ^leader_election_master_status$
1657 whitelist.10 = ^rest_client_requests_total$
1658 whitelist.11 = ^rest_client_request_duration_seconds_sum$
1659 whitelist.12 = ^process_cpu_seconds_total$
1660 whitelist.13 = ^process_resident_memory_bytes$
1661 whitelist.14 = ^process_virtual_memory_bytes$
1662 whitelist.15 = ^process_open_fds$
1663 whitelist.16 = ^process_max_fds$
1664 whitelist.17 = ^go_goroutines$
1665 whitelist.18 = ^process_start_time_seconds$
1666
1667 [input.prometheus::coredns]
1668
1669 disabled = false
1670
1671 type = openshift_prometheus
1672
1673 index =
1674
1675 source = coredns
1676
1677 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1678 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1679 # metricsOutput: an output whose HEC token can write to the metrics index.
1680 metricsIndex =
1681 metricsOutput =
1682
1683 # Override host (environment variables are supported)
1684 host = ${KUBERNETES_NODENAME}
1685
1686 source = coredns
1687
1688 interval = 60s
1689
1690 timeout = 60s
1691
1692 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1693 # podSelector (with podNamespace): the pods on this node a label selector matches;
1694 # endpoint(s) beside it are the fallback on a node where none runs.
1695 podNamespace = openshift-dns
1696 podSelector = dns.operator.openshift.io/daemonset-dns=default
1697
1698 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1699
1700 # endpoint.N: literal URLs, the first that answers
1701
1702 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1703
1704 # === HOW: port (number) or portName, plus scheme and path ===
1705 port = 9154
1706
1707 scheme = https
1708 path = /metrics
1709
1710 # token for "Authorization: Bearer $(cat tokenPath)"
1711 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1712
1713 # server certificate for certificate validation
1714 certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
1715
1716 # the name the server certificate is verified against, when not the address dialed
1717 caName = dns-default.openshift-dns.svc
1718
1719 clientCertPath =
1720
1721 insecure = false
1722
1723 includeHelp = false
1724
1725 output =
1726
1727 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1728
1729 whitelist.1 = ^coredns_.+$
1730 whitelist.2 = ^go_gc_duration_seconds$
1731 whitelist.3 = ^go_goroutines$
1732 whitelist.4 = ^go_memstats_heap_inuse_bytes$
1733 whitelist.5 = ^process_cpu_seconds_total$
1734 whitelist.6 = ^process_network_receive_bytes_total$
1735 whitelist.7 = ^process_network_transmit_bytes_total$
1736 whitelist.8 = ^process_open_fds$
1737 whitelist.9 = ^process_resident_memory_bytes$
1738 whitelist.10 = ^process_start_time_seconds$
1739 whitelist.11 = ^process_virtual_memory_bytes$
1740
1741 [input.prometheus::etcd]
1742
1743 disabled = false
1744
1745 type = openshift_prometheus
1746
1747 index =
1748
1749 source = etcd
1750
1751 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1752 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1753 # metricsOutput: an output whose HEC token can write to the metrics index.
1754 metricsIndex =
1755 metricsOutput =
1756
1757 # Override host (environment variables are supported)
1758 host = ${KUBERNETES_NODENAME}
1759
1760 source = etcd
1761
1762 interval = 60s
1763
1764 timeout = 60s
1765
1766 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1767 # podSelector (with podNamespace): the pods on this node a label selector matches;
1768 # endpoint(s) beside it are the fallback on a node where none runs.
1769
1770 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1771
1772 # endpoint.N: literal URLs, the first that answers
1773
1774 endpoint.1 = https://:9979/metrics
1775 endpoint.2 = https://:9978/metrics
1776
1777 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1778 nodeSelector = node-role.kubernetes.io/master
1779
1780 # === HOW: port (number) or portName, plus scheme and path ===
1781
1782 # token for "Authorization: Bearer $(cat tokenPath)"
1783 tokenPath =
1784
1785 # server certificate for certificate validation
1786 certPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-*.crt
1787
1788 clientCertPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.crt
1789 clientKeyPath = /rootfs/etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-peer-*.key
1790
1791 insecure = true
1792
1793 includeHelp = false
1794
1795 output =
1796
1797 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1798
1799 whitelist.1 = ^etcd_server_leader_changes_seen_total$
1800 whitelist.2 = ^etcd_server_has_leader$
1801 whitelist.3 = ^etcd_server_is_leader$
1802 whitelist.4 = ^etcd_server_proposals_committed_total$
1803 whitelist.5 = ^etcd_server_proposals_applied_total$
1804 whitelist.6 = ^etcd_server_proposals_pending$
1805 whitelist.7 = ^etcd_server_proposals_failed_total$
1806 whitelist.8 = ^etcd_disk_wal_fsync_duration_seconds_sum$
1807 whitelist.9 = ^etcd_disk_wal_fsync_duration_seconds_bucket$
1808 whitelist.10 = ^etcd_disk_backend_commit_duration_seconds_sum$
1809 whitelist.11 = ^etcd_disk_backend_commit_duration_seconds_bucket$
1810 whitelist.12 = ^etcd_network_client_grpc_.*$
1811 whitelist.13 = ^grpc_server_handled_total$
1812 whitelist.14 = ^etcd_network_peer_round_trip_time_seconds_bucket$
1813 whitelist.15 = ^etcd_network_peer_sent_failures_total$
1814 whitelist.16 = ^etcd_mvcc_db_total_size_in_bytes$
1815 whitelist.17 = ^etcd_mvcc_db_total_size_in_use_in_bytes$
1816 whitelist.18 = ^etcd_server_quota_backend_bytes$
1817 whitelist.19 = ^etcd_debugging_mvcc_keys_total$
1818 whitelist.20 = ^etcd_server_slow_apply_total$
1819 whitelist.21 = ^etcd_server_slow_read_indexes_total$
1820 whitelist.22 = ^etcd_server_read_indexes_failed_total$
1821 whitelist.23 = ^etcd_server_health_failures$
1822 whitelist.24 = ^process_cpu_seconds_total$
1823 whitelist.25 = ^process_resident_memory_bytes$
1824 whitelist.26 = ^process_virtual_memory_bytes$
1825 whitelist.27 = ^process_open_fds$
1826 whitelist.28 = ^process_max_fds$
1827 whitelist.29 = ^go_goroutines$
1828 whitelist.30 = ^process_start_time_seconds$
1829 whitelist.31 = ^etcd_server_version$
1830 whitelist.32 = ^etcd_cluster_version$
1831 whitelist.33 = ^etcd_server_go_version$
1832 whitelist.34 = ^etcd_server_id$
1833 whitelist.35 = ^etcd_network_peer_round_trip_time_seconds_sum$
1834
1835 # counters, by name, whose series are not sent until they first rise above 0
1836 skipZeroCounters.1 = ^grpc_server_handled_total$
1837
1838 [input.prometheus::kubelet]
1839
1840 disabled = false
1841
1842 type = openshift_prometheus
1843
1844 index =
1845
1846 source = kubelet
1847
1848 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1849 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1850 # metricsOutput: an output whose HEC token can write to the metrics index.
1851 metricsIndex =
1852 metricsOutput =
1853
1854 # Override host (environment variables are supported)
1855 host = ${KUBERNETES_NODENAME}
1856
1857 source = kubelet
1858
1859 interval = 60s
1860
1861 timeout = 60s
1862
1863 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1864 # podSelector (with podNamespace): the pods on this node a label selector matches;
1865 # endpoint(s) beside it are the fallback on a node where none runs.
1866
1867 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1868
1869 # endpoint.N: literal URLs, the first that answers
1870
1871 endpoint.1 = https://${KUBERNETES_NODEIP}:10250/metrics
1872
1873 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1874
1875 # === HOW: port (number) or portName, plus scheme and path ===
1876
1877 # token for "Authorization: Bearer $(cat tokenPath)"
1878 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1879
1880 # server certificate for certificate validation
1881 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1882
1883 clientCertPath =
1884
1885 insecure = true
1886
1887 includeHelp = false
1888
1889 output =
1890
1891 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1892
1893 whitelist.1 = ^(kubernetes|openshift)_build_info$
1894 whitelist.2 = ^kubelet_runtime_operations_duration_seconds_sum$
1895 whitelist.3 = ^kubelet_runtime_operations_errors_total$
1896 whitelist.4 = ^kubelet_cgroup_manager_duration_seconds_sum$
1897 whitelist.5 = ^storage_operation_duration_seconds_sum$
1898 whitelist.6 = ^kubelet_volume_stats_.+$
1899 whitelist.7 = ^kubelet_running_pods$
1900 whitelist.8 = ^kubelet_running_containers$
1901 whitelist.9 = ^kubelet_desired_pods$
1902 whitelist.10 = ^kubelet_pleg_relist_duration_seconds_sum$
1903 whitelist.11 = ^kubelet_pod_start_duration_seconds_sum$
1904 whitelist.12 = ^kubelet_pod_worker_duration_seconds_sum$
1905 whitelist.13 = ^kubelet_started_pods_errors_total$
1906 whitelist.14 = ^kubelet_certificate_manager_client_ttl_seconds$
1907 whitelist.15 = ^rest_client_requests_total$
1908 whitelist.16 = ^rest_client_request_duration_seconds_sum$
1909 whitelist.17 = ^process_cpu_seconds_total$
1910 whitelist.18 = ^process_resident_memory_bytes$
1911 whitelist.19 = ^process_virtual_memory_bytes$
1912 whitelist.20 = ^process_open_fds$
1913 whitelist.21 = ^process_max_fds$
1914 whitelist.22 = ^go_goroutines$
1915 whitelist.23 = ^process_start_time_seconds$
1916
1917 [input.prometheus::kubernetes-api]
1918
1919 disabled = false
1920
1921 type = openshift_prometheus
1922
1923 index =
1924
1925 source = kubernetes-api
1926
1927 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
1928 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
1929 # metricsOutput: an output whose HEC token can write to the metrics index.
1930 metricsIndex =
1931 metricsOutput =
1932
1933 # Override host (environment variables are supported)
1934 host = ${KUBERNETES_NODENAME}
1935
1936 source = kubernetes-api
1937
1938 interval = 60s
1939
1940 timeout = 60s
1941
1942 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
1943 # podSelector (with podNamespace): the pods on this node a label selector matches;
1944 # endpoint(s) beside it are the fallback on a node where none runs.
1945 podNamespace = openshift-kube-apiserver
1946 podSelector = app=openshift-kube-apiserver
1947
1948 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
1949
1950 # endpoint.N: literal URLs, the first that answers
1951
1952 endpoint.1 = https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics
1953
1954 # nodeSelector: the nodes the literal endpoint(s) are scraped on
1955 nodeSelector = node-role.kubernetes.io/master
1956
1957 # === HOW: port (number) or portName, plus scheme and path ===
1958 port = 6443
1959
1960 scheme = https
1961 path = /metrics
1962
1963 # token for "Authorization: Bearer $(cat tokenPath)"
1964 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
1965
1966 # server certificate for certificate validation
1967 certPath = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
1968
1969 # the name the server certificate is verified against, when not the address dialed
1970 caName = kubernetes
1971
1972 clientCertPath =
1973
1974 insecure = false
1975
1976 includeHelp = false
1977
1978 output =
1979
1980 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
1981
1982 whitelist.1 = ^(kubernetes|openshift)_build_info$
1983 whitelist.2 = ^authenticated_user_requests$
1984 whitelist.3 = ^apiserver_request_total$
1985 whitelist.4 = ^apiserver_current_inflight_requests$
1986 whitelist.5 = ^apiserver_flowcontrol_current_inqueue_requests$
1987 whitelist.6 = ^apiserver_request_terminations_total$
1988 whitelist.7 = ^apiserver_client_certificate_expiration_seconds_bucket$
1989 whitelist.8 = ^apiserver_audit_event_total$
1990 whitelist.9 = ^apiserver_audit_error_total$
1991 whitelist.10 = ^apiserver_resource_objects$
1992 whitelist.11 = ^apiserver_storage_objects$
1993 whitelist.12 = ^process_cpu_seconds_total$
1994 whitelist.13 = ^process_resident_memory_bytes$
1995 whitelist.14 = ^process_virtual_memory_bytes$
1996 whitelist.15 = ^process_open_fds$
1997 whitelist.16 = ^process_max_fds$
1998 whitelist.17 = ^go_goroutines$
1999 whitelist.18 = ^process_start_time_seconds$
2000 whitelist.19 = ^apiserver_request_duration_seconds_sum$
2001
2002 [input.prometheus::scheduler]
2003
2004 disabled = false
2005
2006 type = openshift_prometheus
2007
2008 index =
2009
2010 source = scheduler
2011
2012 # indexType (events, metrics or both) overrides [general] defaultIndexType. Set metricsIndex or
2013 # [output.splunk] defaultMetricsIndex: the HEC token's default index is normally an events index.
2014 # metricsOutput: an output whose HEC token can write to the metrics index.
2015 metricsIndex =
2016 metricsOutput =
2017
2018 # Override host (environment variables are supported)
2019 host = ${KUBERNETES_NODENAME}
2020
2021 source = scheduler
2022
2023 interval = 60s
2024
2025 timeout = 60s
2026
2027 # === WHERE: pick one of podSelector, endpointSlice, service, or endpoint(s) ===
2028 # podSelector (with podNamespace): the pods on this node a label selector matches;
2029 # endpoint(s) beside it are the fallback on a node where none runs.
2030 podNamespace = openshift-kube-scheduler
2031 podSelector = app=openshift-kube-scheduler
2032
2033 # endpointSlice / service: <name>.<namespace>. Omit the namespace to aggregate cluster-wide.
2034
2035 # endpoint.N: literal URLs, the first that answers
2036
2037 endpoint.1 = https://127.0.0.1:10259/metrics
2038
2039 # nodeSelector: the nodes the literal endpoint(s) are scraped on
2040 nodeSelector = node-role.kubernetes.io/master
2041
2042 # === HOW: port (number) or portName, plus scheme and path ===
2043 port = 10259
2044
2045 scheme = https
2046 path = /metrics
2047
2048 # token for "Authorization: Bearer $(cat tokenPath)"
2049 tokenPath = /var/run/secrets/kubernetes.io/serviceaccount/token
2050
2051 # server certificate for certificate validation
2052 certPath = /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
2053
2054 # the name the server certificate is verified against, when not the address dialed
2055 caName = scheduler.openshift-kube-scheduler.svc
2056
2057 clientCertPath =
2058
2059 insecure = false
2060
2061 includeHelp = false
2062
2063 output =
2064
2065 # Regular expressions on the metric name: with a whitelist, only the matching metrics are sent
2066
2067 whitelist.1 = ^(kubernetes|openshift)_build_info$
2068 whitelist.2 = ^scheduler_scheduling_attempt_duration_seconds_sum$
2069 whitelist.3 = ^scheduler_scheduling_algorithm_duration_seconds_sum$
2070 whitelist.4 = ^scheduler_pending_pods$
2071 whitelist.5 = ^scheduler_schedule_attempts_total$
2072 whitelist.6 = ^scheduler_queue_incoming_pods_total$
2073 whitelist.7 = ^scheduler_preemption_attempts_total$
2074 whitelist.8 = ^leader_election_master_status$
2075 whitelist.9 = ^rest_client_requests_total$
2076 whitelist.10 = ^rest_client_request_duration_seconds_sum$
2077 whitelist.11 = ^process_cpu_seconds_total$
2078 whitelist.12 = ^process_resident_memory_bytes$
2079 whitelist.13 = ^process_virtual_memory_bytes$
2080 whitelist.14 = ^process_open_fds$
2081 whitelist.15 = ^process_max_fds$
2082 whitelist.16 = ^go_goroutines$
2083 whitelist.17 = ^process_start_time_seconds$
2084
2085 [diagnostics::cpu-vulnerabilities]
2086 settings.interval = 1h
2087 settings.path = /rootfs/sys/devices/system/cpu/vulnerabilities/*
2088
2089 [diagnostics::node-reboot-required]
2090 settings.interval = 1h
2091 settings.path = /rootfs/run/reboot-required*