mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
92 lines
2.7 KiB
Plaintext
92 lines
2.7 KiB
Plaintext
// Module included in the following assemblies:
|
||
//
|
||
// * security/rosa-forwarding-control-plane-logs.adoc
|
||
:_mod-docs-content-type: PROCEDURE
|
||
[id="rosa-set-up-cloudwatch-log-group_{context}"]
|
||
= Setting up the CloudWatch log group
|
||
|
||
[role="_abstract"]
|
||
If you have logs requiring immediate action or organization, set up an Amazon CloudWatch log group.
|
||
|
||
.Prerequisites
|
||
|
||
* You have created an IAM role and policy.
|
||
|
||
.Procedure
|
||
|
||
. Create the CloudWatch log group by running the following command:
|
||
+
|
||
[source,terminal]
|
||
----
|
||
$ aws logs create-log-group –log-group-name <your_log_group_name>
|
||
----
|
||
+
|
||
. In your {product-title} cluster, configure the log forwarder to use the CloudWatch log group by applying the following JSON sample:
|
||
+
|
||
[source,json]
|
||
----
|
||
{
|
||
"Version": "2012-10-17",
|
||
"Statement": [
|
||
{
|
||
"Sid": "CreatePutLogs",
|
||
"Effect": "Allow",
|
||
"Action": [
|
||
"logs:CreateLogStream",
|
||
"logs:PutLogEvents"
|
||
],
|
||
"Resource": "<your_log_group_arn>:*"
|
||
},
|
||
{
|
||
"Sid": "DescribeLogs",
|
||
"Effect": "Allow",
|
||
"Action": [
|
||
"logs:DescribeLogGroups",
|
||
"logs:DescribeLogStreams"
|
||
],
|
||
"Resource": "*"
|
||
}
|
||
]
|
||
}
|
||
----
|
||
+
|
||
. Attach the policy to the CloudWatch role by running the following command:
|
||
+
|
||
[source,terminal]
|
||
----
|
||
$ aws iam put-role-policy \
|
||
--role-name CustomerLogDistribution-RH \
|
||
--policy-name Allow-CloudWatch-Writes \
|
||
--policy-document file://cloudwatch-policy.json
|
||
----
|
||
+
|
||
. Configure your {product-title} cluster to forward logs to the CloudWatch log group by applying the following sample YAML list:
|
||
+
|
||
[source,yaml]
|
||
----
|
||
cloudwatch:
|
||
cloudwatch_log_role_arn: "arn:aws:iam::123456789012:role/RosaCloudWatch"
|
||
cloudwatch_log_group_name: "rosa-logs"
|
||
applications:
|
||
- "<example_app1>"
|
||
groups:
|
||
- "<example_group1>"
|
||
----
|
||
<example_app1>:: Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".
|
||
<example_group1>:: Add one or more of the following groups: `API`, `Authentication`, `Controller Manager`, `Scheduler`, and `Other`.
|
||
. Enable the log forwarder to send logs to your {product-title} cluster.
|
||
.. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:
|
||
+
|
||
[source,terminal]
|
||
----
|
||
$ rosa create cluster --log-fwd-config="<path_to_file>.yaml"
|
||
----
|
||
+
|
||
.. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:
|
||
+
|
||
[source,terminal]
|
||
----
|
||
$ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml"
|
||
----
|
||
|