Skip to main content
Version: 3.0

Syslog export overview

Syslog export overview​

CubeCOS collects logs from across the stack including OpenStack services, Ceph, the kernel, infrastructure components, and can forward them to an external syslog server for centralized monitoring and long-term retention.

Syslog export is useful when your organization:​

  • Uses a SIEM or log management platform (such as Splunk, Graylog, or an ELK stack) to aggregate logs from multiple systems
  • Requires logs to be retained outside the cluster for compliance or audit purposes
  • Needs to monitor CubeCOS remotely without direct access to control nodes

How it works​

CubeCOS uses Logstash to process and route logs. Logstash reads log events from internal Kafka topics, applies any configured transformations, and forwards the output to your syslog server over UDP or TCP.

Export data flow
CubeCOS components β†’ Kafka β†’ Logstash β†’ Syslog server

Each log source publishes to a Kafka topic. Logstash consumes those topics through a pipeline and writes to the syslog output plugin. You can run multiple pipelines in parallel β€” one for each destination or log type.

What gets exported​

Syslog export covers logs from the following components:

Infrastructure​

  • System logs (/var/log/messages)
  • Kernel events
  • Ceph distributed storage
  • Pacemaker cluster management
  • Zookeeper coordination service

OpenStack services​

  • Nova, Cinder, Neutron, Barbican, Manila, Freezer, Keystone, Sahara, Heat, Masakari

Monitoring and observability​

  • Telegraf, Grafana, Ceilometer, Monasca, InfluxDB, Kapacitor, Elasticsearch

Authentication​

  • Keystone authentication logs (/var/log/httpd/keystone_access.log)

Other​

  • Apache HTTP Server (/var/log/httpd/, including Keystone access logs)
  • RabbitMQ message queue
  • Logstash itself

Next steps​

Last updated on by Brian Su