You can add your log servers to ZStack Cloud. A log server is used to collect management node logs or platform operation logs. You can use the collected logs for operation trace or troubleshooting, This makes your O&M more efficient.
Log Types
ZStack Cloud supports collecting three types of logs through log servers: management node logs, platform operation logs, and SNAT logs. You need to add separate log servers for each log type.
Management Node Logs
Only admin or platform managers can add management node log servers.
For management node logs, only Syslog log servers are supported. The server collects and stores management node logs through its built-in syslog server.
Platform Operation Logs
Admin, platform managers or project members can add platform operation log servers.
If added by a project member, the log server receives the operation logs of users in this project. You can add a maximum of one platform operation log server for each project.
If added by the admin or platform manager, the log server receives operation logs of all users of the Cloud.
For platform operation logs, Syslog, Elasticsearch, Forward, Kafka, Loki, and other log server types are supported.
SNAT Logs: Receives SNAT forwarding logs from the VPC router. Only Syslog log servers are supported.
Prerequisites
This tutorial assumes you have installed the latest version of ZStack Cloud and deployed necessary resources.
For more information, see the Installation and Deployment chapter in the User Guide.
This tutorial starts from adding a log server and introduces its functionality.
You need to prepare a log server in advance to store logs.
Typical Scenarios
Collect Management Node Logs Using a Log Server
About this task
For scenarios requiring collection of management node logs through a log server to analyze the Cloud health status, you can use the following solution.
You need to deploy the latest ZStack Cloud environment and a
Syslog log server.
The detailed procedure is as follows:
Configure the syslog server on your log server.
Add a log server to the Cloud.
Verify the log server.
Procedure
Configure the syslog server on your log server.
You need to prepare a log server for receiving log information in advance, and ensure that the syslog server is installed on it.
On the log server, perform the following configurations:
Open the /etc/rsyslog.conf file and locate the following commands:
#$ModLoad imudp
#$UDPServerRun 514
Modify preceding commands to the following to enable UDP configuration:
$ModLoad imudp
$UDPServerRun 514
Add the following command to set the log facility (This scenario chooses LOCAL1):
local1.* /var/log/test.log
Save the configuration and run the following command to restart the syslog service:
systemctl restart rsyslog
Figure 1. Configure Syslog Server
Note: If the Cloud UI reports a Log server unreachable error during log server addition, you need to run the following command on the log server to enable 7/tcp port listening for Inet Address isReachable:
On the main menu of ZStack Cloud, choose Settings > Platform Setting > Log Server. Then the Log Server page is displayed. Click Add Log Server. On the displayed page, set the following parameters:
Name: Enter a name for the log server. The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the log server.
Log Type: Select Management Node Log.
Output: Select the output type. Only Syslog is supported.
Address: Enter the server address. You can enter an IP address, domain name, or URL pattern.
Port: Enter a port to provide services.
Protocol: Select the data transfer protocol. In this scenario, select UDP.
Log Facility: Select a log facility category. Valid values: LOCAL0 to LOCAL7.
Note:
Select a value that is consistent with the log identifier you configure in the rsylog.conf file of the log server. Then, the Cloud can send logs correctly to this server.
For this scenario, the log facility in rsyslog.conf is set to LOCAL1, so enter LOCAL1 here.
Log Severity Level: Select a log severity level. Valid values from lowest to highest: ALL, TRACE, DEBUG, INFO, WARN, ERROR, and FATAL.
Note: Only logs of this level or higher levels will be received by the log server.
For example, if you select the severity level as WARN, the log server can receive logs of the WARN level and higher levels (ERROR and FATAL).
If you select the severity level as ALL, the log server receives logs of all levels.
Figure 2. Add Management Node Log Server
Verify the log server.
After configuration, run the following command on the log server to check if it receives management node logs:
cat /var/log/test.log
Figure 3. View Management Node Logs The log server successfully receives management node logs. The configuration works.
Collect Platform Operation Logs Using a Log Server
About this task
A project requires a log server to collect platform operation logs for auditing project member activities.
The following table lists sample configurations for visualization analysis on the collected logs:
Configuration Item
Configuration Details
Project Name
Project-1
User Name
User-1
Log Server Type
Loki
Log Server IP
172.xx.xx.145
Log Server Port
3100
Visualization Tool
Grafana
You can use the solution described in this chapter. The procedure is as follows:
Prepare the Loki log server.
Connect the Loki log server to the Cloud.
Set up Grafana and connect it to the Loki log server.
Collect platform operation logs.
Procedure
Prepare the Loki log server.
Set up a log server in advance to receive logs. In this scenario, use a Loki log server.
Connect the Loki log server to the Cloud.
Log in to ZStack Cloud as project member User-1. On the main menu, choose Settings > Platform Setting > Log Server. On the Log Server page, click Add Log Server. Then the Add Log Server page is displayed.
Note: Ensure the project member has log server operation permissions.
On the displayed page, set the following parameters:
Name: Enter a name for the log server. The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the log server.
Log Type: Select Cloud Operation Log.
Output: Select the output type. In this scenario, select Loki.
Address: Enter the log server address. You can enter an IP address, domain name, or URL pattern. In this scenario, enter 172.xx.xx.145.
Port: Enter a port to provide services. In this scenario, enter 3100.
Labels Job: Add job labels to logs. You can use this label to quickly filter logs on the log server. In this scenario, enter job=project-1.
TLS: Choose whether to enable Transport Layer Security (TLS). In this scenario, disable the switch.
User name: Optional. Enter the user name for identity authentication. Leave blank in this scenario.
Password: Optional. Enter the password corresponding to the user name. Leave blank in this scenario.
Figure 4. Add Loki Log Server
Set up Grafana and connect it to the Loki log server.
Deploy Grafana.
Set up the Grafana application. You can deploy it manually or through the ZStack Cloud Application Market.
To deploy through ZStack Cloud Application Market:
Log in using the admin account.
On the main menu of ZStack Cloud, choose Operational Management > Application Market > Default Application > All.
Locate Grafana and click Install Application.
Figure 5. Install Grafana through Application Market
Connect to the Loki log server in Grafana.
Log in to Grafana. When installed via Application Market, use the default credentials:
User name: admin.
Password: ZStack@123.
On the Grafana main menu, choose Connection > Data Sources
On the Data Sources page, click Add new data source and select Loki as the type.
Set the following parameters:
Name: Enter a data source name. In this scenario, enter loki-172.xx.xx.145.
URL: Enter the full log server URL. In this scenario, enter http://172.xx.xx.145:3100.
Configure other options as needed.
Figure 6. Connect to Loki in Grafana
Collect platform operation logs.
On the Grafana main menu, click Explore. On the Explore page:
Select the connected Loki-172.xx.xx.145 log server.
Set Label filters to job=project-1.
Click Run query to view Project-1's platform operation logs.
Figure 7. View Logs
What to do next
You have now completed collecting platform operation logs through the Loki server.
Note: If the Cloud UI reports a Log server unreachable error during log server addition, you need to run the following command on the log server to enable 7/tcp port listening for Inet Address isReachable:
