OCP4 - Excluding log sources does not work as described in documentation
Issue
-
According to the official OCP4 documentation, when we set a retention policy for one source of logs (application, infrastructure or audit) the other sources will not be collected.
Red Hat OpenShift Container Platform - Configuring the log store:
IMPORTANT
If you do not specify a retention policy for all three log sources, only logs from the sources with a retention policy are stored. For example, if you set a retention policy for the infrastructure and applicaiton logs, but do not set a retention policy for audit logs, the audit logs will not be retained and there will be no audit- index in Elasticsearch or Kibana. -
Nevertheless, even if the retention policy for applications is set, new indexes for infrastructure and audit logs are created:
green open .kibana_1 GbvdVof2RwmTj0MO4yXb-w 1 1 0 0 522b 261b green open app-000007 vjk5lxE6R0OSHOSs3Vr0cQ 3 0 54799797 0 45.4gb 45.4gb green open .kibana_98632_cmr_1 dZmeF30ITMaFavHDeaCg6w 1 1 2 0 110.2kb 55.1kb green open infra-000008 n_kjKZfWSQ6tuIhJV8r7Rw 3 0 70156262 0 45.2gb 45.2gb green open app-000009 8ih90ip4R-GAsdSZbvYLKQ 3 0 57118849 0 47.6gb 47.6gb green open app-000010 lTL4ongKTk-J32fZ9TrsKw 3 0 43049226 0 37.3gb 37.3gb green open app-000005 Xzmv8sdQTtKRl6WhTjyQIA 3 0 57972369 0 48.3gb 48.3gb green open audit-000007 hFB74r5BToWPbZTAx6dXjA 3 0 0 0 783b 783b green open infra-000004 6OsQvxtvSDKnc1Jf3RLA0Q 3 0 73469619 0 47.2gb 47.2gb green open audit-000010 uk-jOlbcSw-avtXmbtK-7g 3 0 0 0 783b 783b green open audit-000008 01GxXUc-Qj2lzb8ufaU4Hg 3 0 0 0 783b 783b green open audit-000006 T1f9hksPQByHiNXh6rYU2Q 3 0 0 0 783b 783b green open audit-000009 KvJyLVGBTeWoNVZgKmhbsg 3 0 0 0 783b 783b green open infra-000006 Kq0J8KUjSeOEZ_ZtWKluIg 3 0 72599831 0 46.7gb 46.7gb green open infra-000003 sIVEPrhUR9SVfAkVmfg_6w 3 0 94107807 0 60.3gb 60.3gb green open .kibana_-2116095764_u005150_1 J0GPYn7vSHuzpGzbkG0FEQ 1 1 2 0 109.2kb 54.6kb
-
That means the behavior is different from what is described in the documentation.
Environment
- Red Hat OpenShift Container Platform (OCP) 4.5, 4.6, 4.7, 4.8
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.