Syslog export overview
Syslog export overview
CubeCOS collects logs from across the stack including OpenStack services, Ceph, the kernel, infrastructure components, and can forward them to an external syslog server for centralized monitoring and long-term retention.
Syslog export is useful when your organization:
- Uses a SIEM or log management platform (such as Splunk, Graylog, or an ELK stack) to aggregate logs from multiple systems
- Requires logs to be retained outside the cluster for compliance or audit purposes
- Needs to monitor CubeCOS remotely without direct access to control nodes
How it works
CubeCOS uses Logstash to process and route logs. Logstash reads log events from internal Kafka topics, applies any configured transformations, and forwards the output to your syslog server over UDP or TCP.
Export data flow
CubeCOS components → Kafka → Logstash → Syslog server
Each log source publishes to a Kafka topic. Logstash consumes those topics through a pipeline and writes to the syslog output plugin. You can run multiple pipelines in parallel — one for each destination or log type.
What gets exported
Syslog export covers logs from the following components:
Infrastructure
- System logs (
/var/log/messages) - Kernel events
- Ceph distributed storage
- Pacemaker cluster management
- Zookeeper coordination service
OpenStack services
- Nova, Cinder, Neutron, Barbican, Manila, Freezer, Keystone, Sahara, Heat, Masakari
Monitoring and observability
- Telegraf, Grafana, Ceilometer, Monasca, InfluxDB, Kapacitor, Elasticsearch
Authentication
- Keystone authentication logs (
/var/log/httpd/keystone_access.log)
Other
- Apache HTTP Server (/var/log/httpd/, including Keystone access logs)
- RabbitMQ message queue
- Logstash itself