When dealing with OpenShift Container Platform (OCP) logs and log persistence, which component collects all node and container logs and stores them…

In the OpenShift Container Platform (OCP) logging architecture, which is based on the EFK stack (Elasticsearch, Fluentd, Kibana), Fluentd acts as the log collector agent. It is deployed as a DaemonSet, meaning an instance runs on every node in the cluster. Fluentd's primary responsibility is to collect all container logs (from stdout/stderr) and node logs (from journald). After collecting the logs, it enriches them with metadata, such as the pod and namespace, and then forwards them to the configured log store, which is typically Elasticsearch. Elasticsearch then stores and indexes the data, often creating separate indices for different projects.

A. Grafana: Grafana is a visualization and analytics tool used for creating dashboards to monitor metrics, primarily from Prometheus, not for collecting logs.

C. Elasticsearch: Elasticsearch is the distributed search engine that serves as the log store. It receives, indexes, and stores the logs sent by Fluentd but does not actively collect them from the nodes.

D. Logstash: While Logstash is a log processing pipeline similar to Fluentd, the default log collector used in the OpenShift Container Platform logging stack is Fluentd.

1. Red Hat OpenShift Container Platform 4.14 Documentation

"About OpenShift Logging": This official documentation describes the components of the logging stack. It states

"The collector is deployed to each node in the OpenShift Container Platform cluster. The collector collects all node and container logs and forwards them to the log store. The collector is an agent that is based on Fluentd." This directly identifies Fluentd as the collector.

2. Red Hat OpenShift Container Platform 4.14 Documentation

"Log collection and forwarding": This section details Fluentd's role: "Fluentd is deployed as a daemon set that calls on each node in the OpenShift Container Platform cluster. It collects log data from the node and applications and forwards it to a variety of outputs

including the default Elasticsearch log store." This confirms Fluentd's function of collecting and forwarding logs for storage.