Using Cluster Logging Forwarder in ARO with Azure Monitor (>=4.13)
This content is authored by Red Hat experts, but has not yet been tested on every supported configuration.
NOTE: Starting from version 5.9, OpenShift Logging supports native forwarding to Azure Monitor and Azure Log Analytics, which is available on clusters running OpenShift 4.13 or higher. Please note that apiVersion was changed from logging.openshift.io/v1 to observability.openshift.io/v1 on OpenShift Logging 6.0, which is the version used on this guide. For clusters running OpenShift 4.12 or earlier, see the
legacy setup document here
for help with configuration.
If you’re running Azure Red Hat OpenShift (ARO), you may want to be able to view and query the logs the platform and your workloads generate in Azure Monitor. With the release of the Cluster Logging Operator version 5.9, this can be done in a single step with some YAML configuration.
Prepare your ARO cluster
-
Deploy an ARO cluster
-
Follow the OpenShift documentation for installing the OpenShift Logging Operator for your version of OpenShift. These instructions cover the various methods (CLI, Web Console) of installation.
-
Set some environment variables
Set up ARO Monitor workspace
-
Add the Azure CLI log extensions
-
Create resource group
If you plan to reuse the same group as your cluster skip this step
-
Create workspace
-
Create a secret for your Azure workspace
Configure OpenShift
-
Create a
Secretto hold the shared key: -
Give permissions for the serviceaccount used in the openshift-logging namespace:
-
Create a
ClusterLogForwarderresource. This will contain the configuration to forward to Azure Monitor:
See the
logging pipeline documentation
for the specifics of how to add audit logs to this configuration.
- Check the ClusterLogForwarder instance status:
Check for logs in Azure
Wait 5 to 15 minutes
-
Query our new Workspace
or
-
Log into Azure Azure Log Insights or you can login into portal and search for Log Analytics workspace
-
Select your workspace
-
Run the Query
