RTF Log Forwarding Approaches to Graylog

Agenda 

• Introduction.
• MuleSoft RTF Platform.
• About Graylog.
• Runtime Fabric Log Forwarding Approaches To Graylog.

Introduction

• RTF controls Mule runtimes in K8s executed docker containers called pods, all packaged with Gravity (Kubernetes cluster and all its applications into a single file called a "Cluster Image") for the expertise of installation and portability. 
• A basic condition is to find a way to promote the Mule application logs to 3rd party logging platforms like Graylog to maintain the logs between redeployment or in the event of crashes.

• Out of the box RTF log forwarding.
• Third-party agent polling.
• Hybrid (Unified way of logging where the customer is using both CloudHub as well as RTF).

MuleSoft RTF Platform

• Anypoint platform is the main offering that has 2 main components. Management plane, and runtime plane. While creating individual containers while deploying the application in RTF, it keeps runtime independent from others and the same follows for continuous deployments.
• As it builds an independent runtime container for each application which makes it to handle multi runtime version deployment. 
• And discussing resource scaling, it supports both horizontal and vertical scaling by simple configuration or easier command to add more resources to existing infrastructure with zero downtime.
• With its health monitoring and configuration persistence behavior, it adheres to escape from application failover. For instance, if any runtime goes out of service then it replicates another runtime instance to avoid platform failover.

About Graylog

Once messages are being received, it can be poked around and explore a bit. There are several pages available, though not all pages may be visible to all users, depending on individual permissions. The following are a few brief descriptions of each page’s purpose and function.

• Streams: Streams are a mechanism used to route messages into categories in real-time
• Searches: Searches may be saved or visualized as dashboard widgets that may be added directly to dashboards from within the search screen.
• DashBoards: Graylog Dashboards are visualizations or summaries of information contained in log events. Each dashboard is populated by one or more widgets.

Alerts: Alerts are composed of two related elements, alert conditions, and alert notifications. Alert conditions are tied to streams and may be based on the content of a field, the aggregated value of a field, or message count thresholds. An alert notification triggers when a condition is met, typically sending an email or HTTP call back to an analyst or another system.

GrayLog Architecture

Runtime Fabric Log Forwarding Approaches To GrayLog

A log appender works in Studio and CloudHub but does not work in RTF.

For example: 

• An Application has a Graylog log appender. when the application runs in Studio, it successfully sends logs to Graylog.

• The connectivity between an RTF worker node and Graylog is verified by sending a log record via curl from worker to GrayLog and it works fine. However, the application deployed on the same worker node is not sending logs to GrayLog.

Runtime Fabric Log Forwarding Configuration for GrayLog

Graylog Input Configuration for Above Port and Protocol on Configured Host

 As soon it is configured, we can see the log started forwarding on the configured Analytic tool. In the below screenshot, we can find RTF application logs are being populated on Graylog.

Tested application logs.

Request on API: 

Logs Populated on Graylog.

MuleSoft Runtime Fabric to GrayLog Log Forwarding