Collect Node systemd Journal Logs with Logtail for Centralized Diagnostics - ACK

ACK clusters integrate with Simple Log Service (SLS) so you can use Logtail, deployed as a DaemonSet, to collect systemd journal logs from all nodes. Journal logs capture node-level events including kubelet activity and OS service output, making them the primary source for diagnosing node crashes, OOM events, and service failures.

Billing

Using this feature incurs charges for both ACK cluster usage and Simple Log Service. Simple Log Service operates on a pay-as-you-go basis. For more information, see ACK billing overview and Simple Log Service billing overview.

Prerequisites

Before you begin, make sure that you have:

The logtail-ds component version 1.0.0 or later installed in the ACK cluster. For installation instructions, see Step 1: Install Logtail.
A kubectl client connected to the ACK cluster. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Step 1: Configure log collection with AliyunLogConfig

AliyunLogConfig is a specialized custom resource definition (CRD) for Simple Log Service. Apply an AliyunLogConfig YAML manifest to create a custom resource (CR) that manages the log collection configuration of logtail-ds.

The following example creates a Logtail configuration named systemd-journal-log-config that collects systemd journal logs from the /logtail_host/var/log/journal directory on all nodes in the cluster.

apiVersion: log.alibabacloud.com/v1alpha1
kind: AliyunLogConfig
metadata:
  # The resource name must be unique within the current ACK cluster.
  name: systemd-journal-log-config
  namespace: kube-system
spec:
  # Target project. Defaults to k8s-log-<your_cluster_id>. Created automatically if it does not exist.
  project: k8s-log-<your_cluster_id>
  # Target Logstore. Created automatically if it does not exist.
  logstore: systemd-journal-log
  logtailConfig:
    inputType: plugin
    configName: systemd-journal-log-config
    inputDetail:
      plugin:
        inputs:
        - type: service_journal
          detail:
            JournalPaths:
            - "/logtail_host/var/log/journal"
            Kernel: true            # Collect kernel logs (from _TRANSPORT=kernel)
            ParsePriority: true     # Parse log priority (0=emerg to 7=debug)
            ParseSyslogFacility: true  # Parse syslog facility codes into readable names

The project and logstore fields accept existing resources or let the system create them automatically.

Collection parameters

Parameter	Description
`JournalPaths`	Paths to systemd journal directories. Logtail reads binary journal files directly from the host at these paths.
`Kernel`	When `true`, includes kernel messages (entries with `_TRANSPORT=kernel`).
`ParsePriority`	When `true`, parses the `PRIORITY` field into a human-readable level: `0`=emerg, `3`=error, `6`=info, `7`=debug.
`ParseSyslogFacility`	When `true`, parses the `SYSLOG_FACILITY` code into its facility name (for example, `daemon`, `kern`, `user`).

Step 2: Query and analyze collected data

After applying the configuration, log on to the Simple Log Service console and navigate to the project and Logstore you specified. For details on query syntax, see Query and analyze logs.

References

logtail-ds can also collect systemd journal logs directly from binary files without the plugin approach. For more information, see Collect systemd journal logs.Simple Log Service console