Outcold Solutions LLC

Collectord performance on CRI-O logs and support for OpenShift 4

December 11, 2018

Switching to CRI-O as container runtime we can see up to 30% performance improvement for Collectord. The reason for that is the format of the Logs. Parsing JSON logs is expensive on a high amount of logs, as strings in JSON fields can have escaped symbols, requiring Collectord to allocate more memory for processing data, and more time on discovering escaped data.

OpenShift is planning to switch to CRI-O in 2019, and we want to be ready for that. Collectord supports logs in CRI-O format starting from Version 5.0 (released in September 2018).

Test on CRI-O. Forwarding 5,000 1Kb events per second. Default configuration.

Comparing to the Version 5.3 running with Docker as container runtime CPU usage went down from 26% to 19%. Memory usage is in the same range of 38Mb.

Collectord with CRI-O

OpenShift 4

You can test Developer Preview of OpenShift 4 right now. OpenShift 4 has a straightforward way to get it up and to run on AWS, KVM or OpenStack. It takes less than 20 minutes to get it up and running on AWS.

Our installation instructions as always work out of the box for OpenShift 4. Collectord discovers and forwards logs (from CRI-O runtime) and collects metrics. Small adjustments require for some Control Plane components, to get all the Control Plane metrics.

OpenShift 4

Focus on your applications, and let us take care of infrastructure monitoring and log forwarding. We got your covered.

performance, collectord, ec2, aws, splunk, cri-o, openshift 4

About Outcold Solutions

Outcold Solutions provides solutions for monitoring Kubernetes, OpenShift and Docker clusters in Splunk Enterprise and Splunk Cloud. We offer certified Splunk applications, which give you insights across all containers environments. We are helping businesses reduce complexity related to logging and monitoring by providing easy-to-use and deploy solutions for Linux and Windows containers. We deliver applications, which help developers monitor their applications and operators to keep their clusters healthy. With the power of Splunk Enterprise and Splunk Cloud, we offer one solution to help you keep all the metrics and logs in one place, allowing you to quickly address complex questions on container performance.