Basic troubleshooting steps for the Logging Operator

This document (000020946) is provided subject to the disclaimer at the end of this document.


Rancher 2.6.x
Rancher 2.7.x
Logging Operator V2


Logs may not be sent from the operator to the chosen destination (ELK, Splunk, etc)


1. On the Rancher menu, go to Workload, Pods.
Check the rancher-logging-root-fluentd-configcheck pod. Its status should be `Completed`.
If it is in a different state, check its logs to understand the error on your configuration.
You may do so by clicking on the three dots menu and 'View Logs'.

2. Check the fluentd logs. They are not written to standard output. Executing on the container rancher-logging-root-fluentd-0 navigate to
/fluentd/out and check the log file there:

$ kubectl -n cattle-logging-system exec -it rancher-logging-root-fluentd-0 -- sh
$ cat /fluentd/out/log

If there are any errors, you can try to fix them or open a case if you need more help.

3. If there are no errors in the two first steps, a simple way to check if the logs are being scrapped is to send them to a file. An output YAML would look like this:

kind: Output
  name: fileoutput
  namespace: default
    path: /tmp/${tag}
Note the ${tag} on the path, required by Fluentd.
In this case, the logs will be available on the /tmp folder of the Pod rancher-logging-root-fluentd-0
If logs are not written to the /tmp folder, open a case with us to help you.

4. If logs are flowing to the file, you need to check your Outputs.
Tweaking the buffer values might be a solution.


This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:000020946
  • Creation Date: 20-Jan-2023
  • Modified Date:24-Feb-2023
    • SUSE Rancher

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center