Log collection and query

The log collection and query function is one of the core observability capabilities of AKE. This function can collect logs of various system components and applications in K8s clusters in real time, helping users quickly query system runtime logs by using rich filter conditions. The log function of AKE has been integrated with the Arcfra observability service based on the Vector/Loki technology stack, and the observability service provides log storage and query functions.

The log system includes the following three parts:

• The observability service client observability-logging-agent, which runs as a DaemonSet on each node in the cluster and is used to collect Pod logs, node system logs, and kernel logs.
• observability-event-agent, which encapsulates event-exporter and observability-agent and runs as a Deployment in the cluster, used to collect Kubernetes event information.
• The observability service client observability-audit-agent, which runs as a DaemonSet on cluster control plane nodes and is used to collect kube-apiserver audit logs.

AKE uses Grafana provided by the observability service to directly access Loki APIs, providing a high-performance log query experience. Flexible cluster configurations support built-in common audit policies (normal, simple, and detailed) and user-defined audit policies, and can independently control persistent collection of logs, events, and audit information.