从零构建TKE生产级日志系统：CLS采集Agent实战指南

Log Source → LogListener Agent → CLS Backend → Storage/Query
              │
              ├── 本地缓存队列
              ├── 压缩加密模块
              └── 智能路由策略

# DaemonSet部署模式确保节点覆盖
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: beta.kubernetes.io/os
          operator: In
          values: [linux]

采集延迟 = 日志生成间隔 + 缓冲时间 + 网络传输时间
  其中缓冲时间 ∝ (内存队列大小 / 日志产生速率)

# 检查节点文件句柄限制
cat /proc/sys/fs/file-max

# 验证内核版本（需>3.10）
uname -r

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cls-log
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
rules:
- apiGroups: [""]
  resources: ["pods", "namespaces"]
  verbs: ["get", "list", "watch"]

apiVersion: apps/v1
kind: DaemonSet
spec:
  template:
    spec:
      containers:
      - name: loglistener
        image: ccr.ccs.tencentyun.com/cls/loglistener:latest
        env:
        - name: LOG_LISTENER_CONFIG
          value: |
            {
              "interval": "3s",
              "max_depth": 5,
              "buffer_size": "100MB"  
            }
        volumeMounts:
        - mountPath: /var/log
          name: varlog
        - mountPath: /containers
          name: containers
      volumes:
      - name: varlog
        hostPath:
          path: /var/log
      - name: containers
        hostPath:
          path: /var/lib/containerd

# 检查Agent进程状态
kubectl -n kube-system exec ds/cls-loglistener -- ps aux | grep loglistener

# 测试日志传输
echo "[$(date)] TEST LOG" >> /var/log/test.log

// CLS采集配置
{
  "type": "delimiter_log",
  "log_begin_regex": "\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}",
  "time_key": "time",
  "time_format": "%Y-%m-%d %H:%M:%S"
}

2023-08-01 10:00:00 ERROR [main] com.example.App 
java.lang.NullPointerException
    at com.example.App.service(UserService.java:42)
    at com.example.App.main(App.java:15)

annotations:
  cls.tencent.com/enable: "true"
  cls.tencent.com/tags: '{"env":"prod","region":"ap-shanghai"}'

# 带标签查询 vs 全文搜索
* | select count(*) where env='prod'   -- 0.2s
* | select count(*) where content like '%prod%'  -- 4.7s

resources:
  limits:
    cpu: "1"
    memory: "512Mi"
  requests:
    cpu: "0.2"
    memory: "128Mi"

# 调整压缩率和批量大小
export CLS_COMPRESSION_LEVEL=6
export CLS_BATCH_SIZE=1048576  # 1MB

所需带宽 = (日志量 × 压缩率) / 采集间隔
  示例：100GB/天日志，压缩率0.3 → 100×10^9×0.3/(86400) ≈ 347KB/s

# 对比节点日志量与CLS接收量
kubectl exec loglistener-ds-xx -- \
  wc -l /var/log/nginx/access.log

* | select count(*) from nginx_log

# 监控Agent内存增长曲线
kubectl -n kube-system top pod -l app=loglistener

# 生成Heap Profile
kill -USR1 $(pgrep loglistener)

{
  "filters": [
    {
      "type": "mask",
      "pattern": "(\d{3})\d{4}(\d{4})",
      "replace": "$1****$2"
    }
  ]
}

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  resources: [{"group": "", "resources": ["secrets"]}]

日志规范化 → 采集策略细化 → 存储分层 → 智能分析
   ↓
遵循Syslog标准  按业务划分Topic   冷热分离存储   内置AI异常检测