IBM Cloud Logs

IBM Cloud Logs is a scalable logging service, which is designed to persist logs while providing users with robust capabilities for querying, tailing, and visualizing their logs efficiently. This service supports enhanced observability for both management and compute resources in the IBM Cloud environment.

Key features

Following are the key features of IBM Cloud Logs:

Scalable log storage and persistence.
Advanced querying, tailing, and visualization capabilities.
Integration options for management and compute Virtual Server Instances (VSIs).

Functionality

Solutions can be enabled for cloud logs to capture infrastructure and application logs from both management and compute nodes. Following are the variables to setup cloud logs:

observability_logs_enable_for_management: Set this value as "false" to disable the IBM Cloud Logs integration. If enabled, infrastructure and LSF application logs from management nodes are captured.
observability_logs_enable_for_compute: Set this value as "false" to disable the IBM Cloud Logs integration. If enabled, infrastructure and LSF application logs from compute nodes (static nodes or worker nodes) are captured.
observability_enable_platform_logs: Setting this value as "true" creates a tenant in the same region in which the IBM® Cloud Logs instance is provisioned to enable platform logs for that region. Run the following command to check whether the platform logs are enabled for your specified region:
```
curl -X GET "https://management.<region>.logs-router.cloud.ibm.com:443/v1/tenants" \
-H "Authorization: Bearer $(ibmcloud iam oauth-tokens | awk '{print $4}')" \
-H "IBM-API-Version: $(date +%Y-%m-%d)"
```
If the output contains an empty tenants list, then it means that the platform logs are not enabled for that region, and you can set the observability_enable_platform_logs variable to enable them. However, if the tenants list is not empty, then the platform logs are already enabled. Attempting to enable them again may result in an error like CreateTenantWithContext failed: Forbidden.

The empty tenants list output looks {“tenants”:[]}

You can have only one tenant per region in an account.
observability_logs_retention_period: The number of days IBM Cloud Logs retains the log data in priority insights. By default the value is set as 7, but the allowed values are 14, 30, 60, and 90.

Verifying Log Flow

To ensure that the logs are successfully flowing to the IBM Cloud Logs instance, test messages are sent through user data.

Go to the cloud_logs_url in the terraform output. For example: https://dashboard.us-east.logs.cloud.ibm.com/bf8eb7dd-1a4b-421d-9bde-2861fdc13b9a
On the left side, click Explore Logs > Logs.
The dashboard results in a visual confirmation of logs that are captured and flow.

Architecture diagram. — Verifying the log flow

Using Filters

Users can apply filters based on the subsystem and application to refine the logs:

To view the logs from management nodes only, select the management subsystem.
To view the logs from compute nodes only, select the compute subsystem.

If your log instance is also configured as a target for Activity Tracker Event Routing, additional application names might appear besides "LSF". To exclude audit events, filter by the LSF application names specifically.

To check whether the cloud logs agent are running on your VSI, SSH into the VSI and run:

systemctl status fluent-bit

For more detailed logs, run:

journalctl -u fluent-bit -e

For IBM Cloud Logs, RHEL8.8 and above version is supported.

For more information on IBM Cloud Logs, go to the documentation here.