SAP Cloud Foundry Syslog

Overview

SAP Cloud Foundry is a cloud plaform that allows you to create polyglot cloud applications in Cloud Foundry. It contains the SAP BTP, Cloud Foundry runtime service, which is based on the open-source application platform managed by the Cloud Foundry Foundation.

The Cloud Foundry environment enables you to develop new business applications and business services, supporting multiple runtimes, programming languages, libraries, and services. You can leverage a multitude of buildpacks, including community innovations and self-developed buildpacks. It also integrates with SAP HANA extended application services, advanced model (SAP HANA XSA). The

PowerConnect Cloud SAP Cloud Foundry Syslog Input allows any application deployed in SAP Cloud Foundry to send it’s logs to the PowerConnect Cloud agent. These logs are then normalized, transformed and pushed to Splunk.

Data Collected

Syslog log data including logged errors and opentracing traces

Status

Beta

Configuration

• Login to the PowerConnect Cloud UI

• Click on the Inputs tab

  

• Click Add New

  

• Under the Platform menu choose CF

• Then under syslog select cf-syslog-http

• Fill in the details for the Syslog Input, the System ID is mapped to the source field in Splunk

  

• Click Save

• The Input should now be created and visible in the Inputs table

• In the Inputs table, click the View button under the Actions column for the newly created Syslog input

  

• Click the unhide button next to the Token and note down the value

  

• The token value will be used to authenticate the syslog data coming from the SAP Cloud Foundry applications
  

• The next step is to create the PowerConnect Cloud syslog service

  CODE

  cf create-user-provided-service powerconnect-syslog -l https://<pc-cloud-url>/ingest/http/<input-id>/<token>

  • <pc-cloud-url> is the url where the pc cloud agent is running

  • <input-id> is the input id of the syslog input you just created

  • <token> is the token belonging to the syslog input you just created
    

• Then bind the new syslog service to the application you wish to send logs from

  CODE

  cf bind-service <app-name> powerconnect-syslog

  • <app-name> is the name of the application you wish to monitor
    

• The application will then need to be restaged

  CODE

  cf restage <app-name>

• After restaging the application logs should now be visible in Splunk under the event_type syslog