Install AxoSyslog with Helm

AxoSyslog provides Helm charts for syslog-ng. You can use these charts to install cloud-ready syslog-ng images created and maintained by Axoflow.

Prerequisites

You must have Helm 3.0 or newer installed to use these charts. Refer to the official Helm documentation for details.

Limitations

The chart provides parameters that make it easy to:

• collect logs using the kubernetes() source, and
• forward the logs using the network() and opensearch() destinations.

To use other sources and destinations, use the config.raw parameter. For the list of configurable parameters and their default values, see Parameters of the AxoSyslog collector Helm chart.

Install

To install the axosyslog-collector charts, complete the following steps.

1. Clone the chart repository.

   helm repo add axosyslog https://axoflow.github.io/axosyslog-charts
   helm repo update
   

2. Install the chart. The following command installs axosyslog-collector into the default namespace. For the list of configurable parameters and their default values, see Parameters of the AxoSyslog collector Helm chart. If you want to use disk-buffers, see also How to use disk-buffers in containers and Kubernetes.

   helm install --generate-name axosyslog/axosyslog-collector
   

   NAME: axosyslog-collector-1683469360
   LAST DEPLOYED: Sun May  7 16:22:40 2023
   NAMESPACE: default
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
   NOTES:
   1. Watch the axosyslog-collector-1683469360 container start.
     $ kubectl get pods --namespace=default -l app=axosyslog-collector-1683469360 -w
   

3. Check that the pod is running.

   kubectl get pods
   

   The output should look like:

   NAME                                   READY   STATUS    RESTARTS   AGE
   axosyslog-collector-1683469360-tptfb   1/1     Running   0          28s
   

How to use disk-buffers in containers and Kubernetes

When you are running AxoSyslog in a container or in Kubernetes, and you want to use disk-buffers, there are some additional things to configure.

• Make sure to mount the disk-buffer files and the persist file (by default, both are stored in /var/lib/syslog-ng) in a way they are not lost when the pod or container is restarted.
  • In Kubernetes, add a persistent volume to your pod and store the disk buffer files (/var/lib/syslog-ng) there.
  • In a container, mount the disk-buffer directory from the host, or store it on a local volume.
• Use a reliable disk-buffer only if your storage is fast enough. For example, a low-speed persistent volume in Kubernetes can cause a significant performance degradation for AxoSyslog.
• Use the latest available version of AxoSyslog, as many related improvements and performance improvements (for example, disk-buffer related metrics) are only supported in recent versions.

If you are using syslog-ng without disk-buffering configured, syslog-ng stores everything in memory, which results in great performance. If you enable disk-buffering, the performance decreases. Make sure to size your observability pipeline appropriately.

Uninstall

Tip: List all installed releases using helm list.

To uninstall a chart release, run:

helm delete <name-of-the-release-to-delete>