Syslog (QRadar)
Forward Kubernetes and OpenShift logs over syslog.
Stream container logs, host logs from the journal and /var/log, API server audit logs, and Kubernetes events from any cluster over syslog, one line per event in a format you choose - to QRadar, Microsoft Sentinel, or any syslog-compatible SIEM.
Installation
Forward logs to QRadar via syslog
→Concepts
What Collectord does, the data model, and how configuration layers
→Configuration
Kubernetes deployment YAML for syslog output
→Annotations
Control output routing, log discovery, multiline, and field extraction per pod
→Configuration
OpenShift deployment files for syslog output
→Annotations reference
Full list of every annotation grouped by datatype
→Troubleshooting
Verify configuration and diagnose deployment issues
→License server
Distribute license keys across clusters from a central URL
→Release history
Changelog of Collectord releases for the syslog forwarder
→Upgrade
Step-by-step version upgrade instructions
→Security
Image security, container privileges, and RBAC access model
→