Logging

Log aggregation

The logs can be forwarded to a Vector log aggregator by providing a discovery ConfigMap for the aggregator and by enabling the log agent:

spec:
  clusterConfig:
    vectorAggregatorConfigMapName: vector-aggregator-discovery
  servers:
    config:
      logging:
        enableVectorAgent: true
        containers:
          opa:
            console:
              level: NONE
            file:
              level: INFO

The Stackable operator for OPA only supports automatic log configuration due to the lack of customization for the OPA logging.

Furthermore, the only customization possible for console output for the bundle-builder container is NONE. This deactivates console logging. Other log levels for console logging in this container are overwritten by the file log level.

Decision logging

The decision logging for OPA can be enabled by setting the log level of the decision logger to any other level than NONE, as shown by example here:

spec:
  clusterConfig:
    vectorAggregatorConfigMapName: vector-aggregator-discovery
  servers:
    config:
      logging:
        enableVectorAgent: true
        containers:
          opa:
            console:
              level: NONE
            file:
              level: INFO
            loggers:
              decision:  (1)
                level: INFO

1	The `decision` logger is configured here.

The decision logs are still filtered by the log level set for the console and file appenders. Therefore, the configuration above would result in decision logs being present on file but not on console.

The logs of the containerdebug process are collected as well. They are labelled container: containerdebug, although no such Kubernetes container exists. The process runs in the background of the opa container. The label comes from /stackable/log/containerdebug, the directory which the operator sets with the FILE_LOG_DIRECTORY environment variable and from which the Vector agent derives the container name. Overriding FILE_LOG_DIRECTORY with envOverrides therefore changes how these logs are aggregated. The agent only collects files one level below /stackable/log, so a sibling directory such as /stackable/log/opa relabels the events instead of dropping them, while any deeper or shallower path stops the aggregation. A path outside /stackable/log also leaves the size-capped log volume.

Further information on how to configure logging, can be found in Logging.