Heavy Forwarder without EFK

[netuse1955]

I am quite new in Splunk architecture (Open Shift Plattform) .
We are using EFK Nodes in our plattform (bare metall) and plan to implement a Heavy Forwarder for collect the system and application logs.
My related questions:
1) is a Splunk HF able to collect all systems logs without fluentd directly?
2) what will be happen in case of the HF fails with the logging files?

[outcoldman]

Not the exact answer to your question, but want to be sure you have not missed it. Our company offers a solution for Monitoring OpenShift (Application Metrics, Application, and host logs forwarding) https://splunkbase.splunk.com/app/3836/. It is very straightforward and simple installation, takes about 5-10 minutes, https://www.outcoldsolutions.com/docs/monitoring-openshift/
After installing it, you will get application metrics, container logs and host logs forwarded to Splunk.
We are also working on the new features, that we are planning to release before the RedHat Summit 2018, including support for Prometheus metrics, system components monitoring, audit logs and more.
Feel free to contact us https://www.outcoldsolutions.com/contact/ or me directly denis@outcoldsolutions.com
We are RedHat technology partners, and our solution is certified with RedHat (including certified images on their registry).

And to answer your questions about our solutions:
- Our collector will collector all system logs and container logs, fluentd is not required in the installation.
- We are using JSON driver, so in case of failure (network issue between collector and Splunk) - our collector will keep retrying to resent, and all the logs will be buffered in JSON files as they usually do.