How to manage sending logs in the platform

Disable sending via ShturvalServicePatch.

To disable sending logs in the platform, use ShturvalServicePatch for local log collection module shturval-log-collector.

General scenario

1. Prepare a manifest ShturvalServicePatch for shturval-log-collector.
2. Load the manifest in the desired cluster via import manifests: Administration → Cluster Actions.
3. Wait for the patch to be applied. On the local log collection module page, the service status will change to Patched, and the downloaded patch will appear on the Applied ShturvalServicePatch tab.

Disable sending all logs #

To completely disable sending, use the global flag platform_logs_enable (see the shturval block in values). Example manifest:

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-log-collector-disable
spec:
  shturvalServiceConfigName: shturval-log-collector
  customvalues:
    shturval:
      platform_logs_enable: false

After applying this patch:

• new events will not be sent to recipients configured via Vector;
• local storage of logs in VictoriaLogs will continue to work according to rotation settings.

Upload the manifest via Import in the Administration → Cluster Actions section. After applying the changes, the service status in the GUI will be updated to Patched.

Screenshot: loading the manifest to disable all logs #

Disable sending a specific type of logs #

If you need to disable sending only one type of logs (for example, journald), without affecting other types and local storage, override the enable parameter for the corresponding block in customvalues.

An example of disabling log sending journald:

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-log-collector-disable-journald
spec:
  shturvalServiceConfigName: shturval-log-collector
  customvalues:
    shturval:
      journald:
        enable: false

Upload the manifest via Import in the Administration → Cluster Actions section. After applying the changes, the service status in the GUI will be updated to Patched.

After applying the patch:

• journald logs will no longer be sent to external systems specified in sinks for journald;
• other types of logs will continue to be processed and sent in accordance with the current configuration.

In the same way, you can disable sending other types of logs (k8s_logs, k8s_audit, k8s_events, auditd) by setting enable: false for them in the corresponding shturval.<log-type> block.

Screenshot: loading manifest to disable journald #