Outcold Solutions - Monitoring Kubernetes, OpenShift and Docker in Splunk
Kubernetes Search in Splunk Monitoring Docker in Splunk Monitoring Kubernetes in Splunk Monitoring OpenShift in Splunk Monitoring Linux in Splunk Monitoring Windows Containers in Splunk Forwarding Logs to Elasticsearch and OpenSearch Forwarding Logs to QRadar
Documentation Blog Contact Us Upload support diagnostics Pricing Evaluation licenses Partners License Agreement Privacy Policy Refund & Cancellation Acceptable Use Policy FAQ
Syslog (QRadar)

Configuration

collectorforkubernetes-syslog.yaml

collectorforkubernetes-syslog.yaml

Created Kubernetes Objects

collectorforkubernetes-syslog.yaml provisions everything Collectord needs to run on the cluster:

  • Namespace collectorforkubernetes-syslog - owns every other object in this list.
  • ClusterRole collectorforkubernetes-syslog - grants get, list, and watch on the API objects Collectord uses to enrich logs and metrics with Kubernetes metadata.
  • ServiceAccount collectorforkubernetes-syslog - the identity Collectord uses to call the Kubernetes API.
  • ClusterRoleBinding collectorforkubernetes-syslog - binds the ServiceAccount to the ClusterRole.
  • ConfigMap collectorforkubernetes-syslog - delivers the configuration files Collectord reads at startup.
  • DaemonSet collectorforkubernetes-syslog - runs Collectord on non-master nodes.
  • DaemonSet collectorforkubernetes-syslog-master - runs Collectord on master nodes.
  • Deployment collectorforkubernetes-syslog-addon - a single Collectord that forwards cluster-scoped data (Kubernetes events, watched objects) once for the whole cluster.

The collectorforkubernetes-syslog.yaml file itself is heavily commented - read through it for the full breakdown of every input and configuration option.