Architecture description for external syslog drain of loggregator incorrect?

[voelzmo]

The description and corresponding image in https://github.com/cloudfoundry/loggregator#architecture state (highlights are mine)

*Doppler*: Responsible for gathering logs from the Metron agents, storing them in temporary buffers, *and forwarding logs to 3rd party syslog drains.*

However, what I gather from the syslog configuration of the metron agents, especially the forwarding configuration is that each component forwards their logs to a configured external syslog drain.

Is my understanding correct that architectural description and implementation are different in this case? Or is it that the configuration is actually done on each machine where the metron agent is installed, but only takes effect on doppler?

Thanks!

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/103775358.

[roxtar]

Hi @voelzmo

You are right. The syslog forwarding configuration is configured to forward logs to external syslog drains for components. The actual syslog forwarding in this case is not done by the loggregator system, but by rsyslog. Only the configuration is part of the loggregator.

The description though is for application logs. Syslog drains for applications can be configured on a per-application basis and doppler servers are responsible for forwarding the logs to the respective syslog drains.

Does that help?

[roxtar]

In addition to this, we also have a story to document how to configure syslog drains for components in our backlog. I hope that covers your question.

[voelzmo]

Dear @roxtar thanks for clearing that up. From the image linked in the Readme.md it wasn't clear to me that this only refers to application logs. You find other CF components such as Router and API in this picture as well. Their log, however, are taking a different path to an external drain, if I understand that correctly.

The entire text in https://github.com/cloudfoundry/loggregator#architecture could probably mention which parts apply to the logs of all CF components, and which parts relate to CF applications only. There is always a bit confusion around which logs are available through the firehose, which are going through doppler, and where we might experience message loss, for example.

Thanks for adding the task to document configuration of external syslog drains. While we are using external drains for applications as well as system components already, I wasn't sure about the actual flow of data in both cases.

Has this been a deliberate decision to keep the two flows separate and are are there any plans to maybe have doppler take care of an external drain for infrastructure logs as well?

[roxtar]

We will change the README to make it clear. We have talked about component logs flowing through loggregator but we haven't scheduled that yet.

[erikjasiak]

Hey @voelzmo -

There have been plans to to have loggregator handle infrastructure logs for awhile; as usual, the challenge is prioritizing an ideal solution once you have a passable one, and making sure the reliability was there.

We're rapidly catching up to it on the priority list though; watch this space.

Erik

[Jim-Campbell]

Diagram updated to show only app logs.