input-auditd.yaml

Documentation: edge-infra.dev/config/pallets/o11y/fluentbit/base/k8s-node

     1apiVersion: fluentbit.fluent.io/v1alpha2
     2kind: ClusterInput
     3metadata:
     4  name: k8s-node-auditd
     5  labels:
     6    fluentbit.fluent.io/enabled: "true"
     7spec:
     8  alias: auditd-tail
     9  tail:
    10    db: /var/log/flb_auditd.db
    11    memBufLimit: 100MB
    12    path: /var/log/audit/audit.log
    13    refreshIntervalSeconds: 10
    14    tag: k8s_node.auditd.$${NODE_NAME}

View as plain text