Installation

This guide walks you through installing the syslog forwarder end-to-end on either Kubernetes or OpenShift: pointing Collectord at your syslog server, accepting the license, and applying the manifest. A typical install takes under 10 minutes and starts forwarding metadata-enriched container logs, host logs, and audit logs. If you don’t have a license yet, you can request a 30-day evaluation.

Install Collectord for Kubernetes / OpenShift

Requirements

• Kubernetes 1.24 or later, or OpenShift 4.11 or later. The Helm charts refuse an older cluster.
• Linux nodes on amd64 or arm64: Collectord’s images are built for both. The Red Hat certified image on registry.connect.redhat.com is built for amd64 only.
• Access to registry.outcold.solutions, which the chart and the manifests pull from:
  • Chart: oci://registry.outcold.solutions/outcoldsolutions/charts/collectord-syslog
  • Image: registry.outcold.solutions/outcoldsolutions/collectorforkubernetes (collectorforopenshift in the OpenShift manifests)
  • Pulls go through ghcr.io and pkg-containers.githubusercontent.com: allow both where egress is filtered.
  • Docker Hub has the same chart and images, with the same tags and digests: oci://registry-1.docker.io/outcoldsolutions/collectord-syslog, and docker.io/outcoldsolutions/<image> in collectord.image.repository (or a manifest’s image: lines).

Installation

Install Collectord with the collectord-syslog Helm chart, on Kubernetes or OpenShift, or apply the manifest rendered from it. Either way, you set:

• The syslog server address.
• Your license key, once you review and accept the license agreement.
• Optionally, a name for the cluster - useful when you’re forwarding from more than one and want to filter by cluster on your SIEM side.

If you’re deploying onto a cluster that’s been running for a while and has a lot of historical logs on disk, Collectord will start by forwarding all of them - which can spike both your network and your SIEM ingestion. Use the [general] settings thruputPerSecond to cap throughput and tooOldEvents to skip events older than a given age.

With Helm

Helm 3.8 or later. Create my_values.yaml:

 1collectord:
 2  configuration:
 3    general:
 4      acceptLicense: true
 5      license: '<your_license_key>'
 6      fields:
 7        cluster: 'development'
 8    outputs:
 9      syslog:
10        default:
11          network: tcp
12          address: '192.168.1.100:514'

Install the chart:

1$ helm install collectorforkubernetes-syslog \
2    --namespace collectorforkubernetes-syslog \
3    --create-namespace \
4    -f my_values.yaml \
5    oci://registry.outcold.solutions/outcoldsolutions/charts/collectord-syslog

On OpenShift, the chart also creates the SecurityContextConstraints its DaemonSet needs. Its README covers the rest of its values.

With the manifest

Download the latest manifest - collectorforkubernetes-syslog.yaml for Kubernetes, or collectorforopenshift-syslog.yaml for OpenShift. The manifest creates the collectorforkubernetes-syslog (or collectorforopenshift-syslog) namespace and deploys every workload it needs. Both are rendered from the chart. Open the one you need and set the same values in its 001-general.conf:

 1[general]
 2
 3acceptLicense = false
 4
 5license =
 6
 7fields.cluster = -
 8
 9...
10
11# Syslog output
12[output.syslog]
13
14address =

A filled-in example:

 1[general]
 2
 3acceptLicense = true
 4
 5license = ...
 6
 7fields.cluster = development
 8
 9...
10
11# Syslog output
12[output.syslog]
13
14address = 192.168.1.100:514

Apply the manifest to a Kubernetes cluster:

1$ kubectl apply -f ./collectorforkubernetes-syslog.yaml

Or to an OpenShift cluster:

1$ oc apply -f ./collectorforopenshift-syslog.yaml

On OpenShift, the manifest carries the SecurityContextConstraints its DaemonSet needs (collectorforopenshift-syslog), bound to its service account, so there is nothing to grant.

Before 26.10, the OpenShift manifest carried no SecurityContextConstraints, and you granted the service account the privileged SCC with oc adm policy add-scc-to-user privileged system:serviceaccount:collectorforopenshift-syslog:collectorforopenshift-syslog.

Check the workloads

Check that the workloads came up - on Kubernetes:

1$ kubectl get all --namespace collectorforkubernetes-syslog

Or on OpenShift:

1$ oc get all --namespace collectorforopenshift-syslog

With Helm, the release’s namespace is collectorforkubernetes-syslog on either platform. Once the images are pulled and the pods are Running, events should start arriving at QRadar (or whichever SIEM you’ve pointed Collectord at) within a minute or two.

By default, Collectord forwards container logs, host logs (the journal and /var/log/*.log), and audit logs when they’re enabled.

Managed clusters

GKE Standard. Collectord runs under the built-in system-node-critical and system-cluster-critical priority classes, and GKE Standard admits those only in a namespace that holds a ResourceQuota for them. The manifest creates that quota, and so does the Helm chart while collectord.priorityClass.resourceQuota is true, the default. Without it, and without a priority class of your own (collectord.priorityClass.name), a new install starts no pod, an upgrade from 26.04 takes Collectord off one node and stops there, and helm without --wait still reports success. To spot it, look for refused pods and a DaemonSet short of its nodes:

1$ kubectl -n collectorforkubernetes-syslog get events --field-selector reason=FailedCreate
2$ kubectl -n collectorforkubernetes-syslog get daemonset

The events read insufficient quota to match these scopes, and the DaemonSet’s CURRENT stays below DESIRED. Set collectord.priorityClass.resourceQuota: true again, and the pods start within a minute or two.

Virtual nodes. The DaemonSet and the addon stay off virtual-kubelet nodes, such as AKS virtual nodes: a virtual node can’t mount the host paths Collectord reads, so those nodes aren’t monitored. The Helm chart keeps them off through collectord.excludeNodes, a map of node labels; set a label to null to allow its nodes again, or add labels of your own:

1collectord:
2  excludeNodes:
3    type: null                                 # allow virtual-kubelet nodes
4    example.com/no-log-collection: "true"      # keep Collectord off these nodes too

In the manifest, the same labels are the nodeAffinity terms of the DaemonSet and the addon Deployment.