Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1518474 - [DOCS] The default log driver is journald
Summary: [DOCS] The default log driver is journald
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Documentation
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: ---
Assignee: Brandi
QA Contact: Anping Li
Vikram Goyal
: 1525564 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2017-11-29 03:08 UTC by Anping Li
Modified: 2018-05-09 00:28 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-04-05 13:53:19 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Bugzilla 1554244 None CLOSED [DOCS] Document how to limit logs fluentd is processing 2019-01-24 06:49:52 UTC

Description Anping Li 2017-11-29 03:08:39 UTC
Document URL:

Section Number and Name: 
Jourald for System Logs and JSON File for Container Logs

Describe the issue: 
In v3.7, Docker log driver is set to journald as the default. A installer bug have been filed

Suggestions for improvement: 

Docker log driver is set to journal as the default for all nodes. For there is no log rate throttling with journal driver. So, there is always a risk for denial-of-service attacks from rogue containers.  you can change the logging-driver to Json-file.

Additional information:

Comment 2 Anping Li 2017-12-14 02:31:39 UTC
According to  It will be in v3.9

Comment 3 Vikram Goyal 2017-12-14 06:20:04 UTC
*** Bug 1525564 has been marked as a duplicate of this bug. ***

Comment 5 Jeff Cantrill 2018-01-19 19:45:48 UTC
I'm not sure where it should be updated be we now default application logs to use the JSON driver instead of journal; node logs still come from journal.  This change was made because of rate limiting in journal.  Originally we moved from json->journal because of a file umount issue that has since been resolved.

Comment 6 Anping Li 2018-01-22 01:55:42 UTC
The bug have been fixed in openshift-ansible-3.9.0-0.22.0

Comment 7 Brandi 2018-01-25 19:37:19 UTC
Thanks, Jeff!


I opened PR7347[1] reverting the content back to JSON instead of journal, with the option to use journal.  


Comment 14 Anping Li 2018-03-05 02:18:27 UTC

It is highly recommended that you use the default value for use-journal. In scenarios where upgrading {product-title} changes the Docker log driver, if use-journal=False is explicitly specified as part of installation, Fluentd still expects to read logs generated using the json-file log driver. This results in a lack of log ingestion. If this has happened within your logging cluster, troubleshoot it.

> use-journal is not supported.  Fluentd automatically determines which log driver. I think we can delete the above section.

Aggregated logging is only supported using the json-file logging driver with Docker. See Updating Fluentd’s Log Source After a Docker Log Driver Update for more information.
> Have we drop the support to journald log driver? If not, we shouldn't said only. (By the way. The crio format logging is supported now.  we need to update this part again soon.)

Comment 17 Anping Li 2018-03-19 05:03:58 UTC

Comment 18 openshift-github-bot 2018-03-20 15:36:37 UTC
Commits pushed to master at
Bug 1518474 Update documentation to reflect change to JSON driver as default
Merge pull request #8012 from bmcelvee/BZ1518474-new

Bug 1518474 Update documentation to reflect change to json-file

Note You need to log in before you can comment on or make changes to this bug.