Cluster logging 5.8.21 on OCP 4.14 with fluentd

CSV and Pods:
```
[root@rdr-man-414log-bastion-0 ~]# oc get csv -n openshift-logging
NAME                             DISPLAY                            VERSION   REPLACES                         PHASE
cluster-logging.v5.8.21          Red Hat OpenShift Logging          5.8.21    cluster-logging.v5.8.20          Succeeded
elasticsearch-operator.v5.8.21   OpenShift Elasticsearch Operator   5.8.21    elasticsearch-operator.v5.8.20   Succeeded
[root@rdr-man-414log-bastion-0 ~]# oc get pods -n openshift-logging
NAME                                            READY   STATUS      RESTARTS   AGE
cluster-logging-operator-c99b6ffd7-796g9        1/1     Running     0          6h49m
collector-6m2sn                                 1/1     Running     0          17m
collector-bwk7f                                 1/1     Running     0          17m
collector-h4qcv                                 1/1     Running     0          17m
collector-ncr7d                                 1/1     Running     0          17m
collector-rcsnw                                 1/1     Running     0          17m
elasticsearch-cdm-q6g4uzlv-1-868b54cd77-4z7s7   2/2     Running     0          27m
elasticsearch-cdm-q6g4uzlv-2-784dc7757b-zknbs   2/2     Running     0          27m
elasticsearch-cdm-q6g4uzlv-3-567f76758c-xx5xs   2/2     Running     0          27m
elasticsearch-im-app-29159490-lzm76             0/1     Completed   0          14m
elasticsearch-im-audit-29159490-qjflr           0/1     Completed   0          14m
elasticsearch-im-infra-29159490-ch5cx           0/1     Completed   0          14m
kibana-9b8c6b98d-8hkpz                          2/2     Running     0          27m
[root@rdr-man-414log-bastion-0 ~]#
```




Cluster Logging:

CloudWatch:

Application logs:
```
{'timestamp': 1749561277101, 'message': '{"@timestamp":"2025-06-10T13:14:36.893929182Z","group_name":"rdr-man-414log-6bclp.application","hostname":"worker-0","kubernetes":{"annotations":{"k8s.ovn.org/pod-networks":"{\\"default\\":{\\"ip_addresses\\":[\\"10.131.1.162/23\\"],\\"mac_address\\":\\"0a:58:0a:83:01:a2\\",\\"gateway_ips\\":[\\"10.131.0.1\\"],\\"routes\\":[{\\"dest\\":\\"10.128.0.0/14\\",\\"nextHop\\":\\"10.131.0.1\\"},{\\"dest\\":\\"172.30.0.0/16\\",\\"nextHop\\":\\"10.131.0.1\\"},{\\"dest\\":\\"100.64.0.0/16\\",\\"nextHop\\":\\"10.131.0.1\\"}],\\"ip_address\\":\\"10.131.1.162/23\\",\\"gateway_ip\\":\\"10.131.0.1\\"}}","k8s.v1.cni.cncf.io/network-status":"[{\\n    \\"name\\": \\"ovn-kubernetes\\",\\n    \\"interface\\": \\"eth0\\",\\n    \\"ips\\": [\\n        \\"10.131.1.162\\"\\n    ],\\n    \\"mac\\": \\"0a:58:0a:83:01:a2\\",\\n    \\"default\\": true,\\n    \\"dns\\": {}\\n}]","openshift.io/scc":"restricted-v2","seccomp.security.alpha.kubernetes.io/pod":"runtime/default"},"container_id":"cri-o://7b6db3ee412f1a5e615b46cea4551238510ea55b0830bed7d54583119cda9dbf","container_image":"quay.io/pravin_dsilva/centos:logtest","container_name":"centos-logtest","labels":{"run":"centos-logtest","test":"centos-logtest"},"namespace_id":"5df41654-e957-47e4-85b4-c6cc4bac2b40","namespace_labels":{"kubernetes_io_metadata_name":"test-logging","pod-security_kubernetes_io_audit":"restricted","pod-security_kubernetes_io_audit-version":"v1.24","pod-security_kubernetes_io_warn":"restricted","pod-security_kubernetes_io_warn-version":"v1.24"},"namespace_name":"test-logging","pod_id":"79dfcf57-7c9f-4cea-b471-5b269eeb062f","pod_ip":"10.131.1.162","pod_name":"centos-logtest-th22m","pod_owner":"ReplicationController/centos-logtest"},"level":"default","log_type":"application","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-application"},"sequence":1722},"stream_name":"kubernetes.var.log.pods.test-logging_centos-logtest-th22m_79dfcf57-7c9f-4cea-b471-5b269eeb062f.centos-logtest.0.log","structured":{"Layer1":"layer1 0","Number":10,"StringNumber":"10","[foobar]":"Bracket Item","foo bar":"Space Item","foo.bar":"Dot Item","foo:bar":"Colon Item","layer2":{"name":"Layer2 1","tips":"Decide by PRESERVE_JSON_LOG"},"level":"debug","message":"MERGE_JSON_LOG=true","{foobar}":"Brace Item"}}', 'ingestionTime': 1749561277401}
```





Audit logs:
```
{'timestamp': 1749569164629, 'message': '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"26bbb018-fbc2-4ced-9c31-d8bd01474f83","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-openstack-infra","verb":"get","user":{"username":"system:serviceaccount:openshift-cluster-version:default","uid":"2c09cb9a-3922-4cda-8928-90f43363278a","groups":["system:serviceaccounts","system:serviceaccounts:openshift-cluster-version","system:authenticated"],"extra":{"authentication.kubernetes.io/pod-name":["cluster-version-operator-7b7cb8c688-j5xgp"],"authentication.kubernetes.io/pod-uid":["ebeba0ed-7e9c-495d-a6d7-fcf589f892eb"]}},"sourceIPs":["10.20.180.130"],"userAgent":"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format","objectRef":{"resource":"namespaces","namespace":"openshift-openstack-infra","name":"openshift-openstack-infra","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-06-10T15:26:04.629778Z","stageTimestamp":"2025-06-10T15:26:04.632316Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \\"cluster-version-operator\\" of ClusterRole \\"cluster-admin\\" to ServiceAccount \\"default/openshift-cluster-version\\""},"@timestamp":"2025-06-10T15:26:04.629778Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:26:04.657382+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":83906,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"MzJkMzZkY2QtZjZjYi00YzU1LWFiNjctN2JmNjcwN2IwZDQ0","log_type":"audit","time":"2025-06-10T15:26:04+00:00"}', 'ingestionTime': 1749569182095}
{'timestamp': 1749569107157, 'message': '{"hostname":"master-0","audit.linux":{"type":"BPF","record_id":"35104"},"message":"type=BPF msg=audit(1749569107.158:35104): prog-id=0 op=UNLOAD","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:25:07.240320+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":58022,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"@timestamp":"2025-06-10T15:25:07.157999+00:00","viaq_msg_id":"Y2RkMWQxYjQtNjIwYS00OThmLWI5NTItZTFiNzZmNGFiZmU2","log_type":"audit","time":"2025-06-10T15:25:07+00:00"}', 'ingestionTime': 1749569129651}
{'timestamp': 1749569161699, 'message': '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"088aae73-2856-4ca7-bc97-c7cad3ddbca9","stage":"ResponseComplete","requestURI":"/apis/user.openshift.io/v1/users/~","verb":"get","user":{"username":"system:serviceaccount:openshift-monitoring:prometheus-k8s","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"],"extra":{"authentication.kubernetes.io/pod-name":["prometheus-k8s-0"],"authentication.kubernetes.io/pod-uid":["9ffb9d79-1b47-4b15-970e-5bd1197c27e7"]}},"sourceIPs":["10.20.180.42","10.128.0.2"],"userAgent":"dockerregistry/v0.0.0 (linux/ppc64le) kubernetes/$Format","objectRef":{"resource":"users","name":"~","apiGroup":"user.openshift.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-06-10T15:26:01.699321Z","stageTimestamp":"2025-06-10T15:26:01.708224Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \\"basic-users\\" of ClusterRole \\"basic-user\\" to Group \\"system:authenticated\\""},"@timestamp":"2025-06-10T15:26:01.699321Z","openshift_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:26:01.886598+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":82754,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"NzNhNjg2OTEtOTZhNi00ZWY1LWExYjYtMDU0ZDYyZTJiMGNi","log_type":"audit","time":"2025-06-10T15:26:01+00:00"}', 'ingestionTime': 1749569182113}
{'timestamp': 1749569237121, 'message': '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"42754444-613c-41b9-88df-9eb1b53abd43","stage":"ResponseComplete","requestURI":"/livez","verb":"get","user":{"username":"system:anonymous","groups":["system:unauthenticated"]},"sourceIPs":["10.20.180.97"],"userAgent":"kube-probe/1.27","responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-06-10T15:27:17.121025Z","stageTimestamp":"2025-06-10T15:27:17.125428Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \\"system:public-info-viewer\\" of ClusterRole \\"system:public-info-viewer\\" to Group \\"system:unauthenticated\\""},"@timestamp":"2025-06-10T15:27:17.121025Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-1","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.97","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:27:17.519033+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":38247,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"NGQ3YTdlYmQtZTViZS00YWJiLWFhM2MtOTZiZjIzNjRkNzU2","log_type":"audit","time":"2025-06-10T15:27:17+00:00"}', 'ingestionTime': 1749569242886}
```





Infrastructure logs:
```
{'timestamp': 1749569096076, 'message': '{"_RUNTIME_SCOPE":"system","_STREAM_ID":"6def6e852af940a1a9d8efc2b38a2fbd","_SYSTEMD_INVOCATION_ID":"5e7dc2435ce94276a9abbdb90cb701c4","systemd":{"t":{"BOOT_ID":"11bba5f5418840f7bdcebe67e3862b78","CAP_EFFECTIVE":"1ffffffffff","CMDLINE":"/usr/bin/kubelet --config=/etc/kubernetes/kubelet.conf --bootstrap-kubeconfig=/etc/kubernetes/kubeconfig --kubeconfig=/var/lib/kubelet/kubeconfig --container-runtime-endpoint=/var/run/crio/crio.sock --runtime-cgroups=/system.slice/crio.service --node-labels=node-role.kubernetes.io/control-plane,node-role.kubernetes.io/master,node.openshift.io/os_id=rhcos --node-ip=10.20.180.83 --minimum-container-ttl-duration=6m0s --cloud-provider= --volume-plugin-dir=/etc/kubernetes/kubelet-plugins/volume/exec --hostname-override= --provider-id= --register-with-taints=node-role.kubernetes.io/master=:NoSchedule --pod-infra-container-image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:032d25e21179546d19c787af90fb598efeed3da9063eb9fa38a342765d3a194a --system-reserved=cpu=500m,memory=1Gi,ephemeral-storage=1Gi --v=2","COMM":"kubelet","EXE":"/usr/bin/kubelet","GID":"0","MACHINE_ID":"dd47ddfba625455b9cbdd84ee0641a7e","PID":"2457","SELINUX_CONTEXT":"system_u:system_r:kubelet_t:s0-s0:c0.c1023","STREAM_ID":"6def6e852af940a1a9d8efc2b38a2fbd","SYSTEMD_CGROUP":"/system.slice/kubelet.service","SYSTEMD_INVOCATION_ID":"5e7dc2435ce94276a9abbdb90cb701c4","SYSTEMD_SLICE":"system.slice","SYSTEMD_UNIT":"kubelet.service","TRANSPORT":"stdout","UID":"0"},"u":{"SYSLOG_FACILITY":"3","SYSLOG_IDENTIFIER":"kubenswrapper"}},"level":"info","message":"I0610 15:24:56.076867    2457 pod_startup_latency_tracker.go:102] \\"Observed pod startup duration\\" pod=\\"openshift-marketplace/redhat-operators-rj6fx\\" podStartSLOduration=1.669223857 podCreationTimestamp=\\"2025-06-10 15:24:54 +0000 UTC\\" firstStartedPulling=\\"2025-06-10 15:24:55.058210889 +0000 UTC m=+1209161.079712619\\" lastFinishedPulling=\\"2025-06-10 15:24:55.465745166 +0000 UTC m=+1209161.487246902\\" observedRunningTime=\\"2025-06-10 15:24:56.07439984 +0000 UTC m=+1209162.095901573\\" watchObservedRunningTime=\\"2025-06-10 15:24:56.07675814 +0000 UTC m=+1209162.098259916\\"","hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:26:04.664369+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":83907,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"@timestamp":"2025-06-10T15:24:56.076916+00:00","viaq_msg_id":"NmM5MTY3MjktMDNlYS00YjczLThmYzEtZTJjN2ZhODQ0ZGZl","log_type":"infrastructure","time":"2025-06-10T15:24:56+00:00"}', 'ingestionTime': 1749569181830}
```





Elasticsearch:


Audit logs:
```
{"_index":"audit-write","_type":"_doc","_id":"ZGNmMTdmZGEtOTg1OC00NDMyLWE1YmMtNTNmMWE0ZTBmMjBi","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"18e2943c-c0fb-4886-abc9-1ac0e23f2aaf","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1/clusterroles/multus-ancillary-tools","verb":"get","user":{"username":"system:serviceaccount:openshift-network-operator:default","uid":"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf","groups":["system:serviceaccounts","system:serviceaccounts:openshift-network-operator","system:authenticated"],"extra":{"authentication.kubernetes.io/pod-name":["network-operator-66dd79c745-wpcrp"],"authentication.kubernetes.io/pod-uid":["3b8d5f24-5371-4560-8459-5fe4adce33c7"]}},"sourceIPs":["10.20.180.130"],"userAgent":"cluster-network-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format","objectRef":{"resource":"clusterroles","name":"multus-ancillary-tools","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:22:29.938842Z","stageTimestamp":"2025-06-10T15:22:29.948635Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"default-account-cluster-network-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"default/openshift-network-operator\""},"@timestamp":"2025-06-10T15:22:29.938842Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:30.220157+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":1365,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"ZGNmMTdmZGEtOTg1OC00NDMyLWE1YmMtNTNmMWE0ZTBmMjBi","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"OTMzM2M0OGMtODEwYS00M2U2LWFmNWMtZmM1ZWIxMzExZWYx","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"daae7ced-e217-488b-a33b-74f3f81929b0","stage":"ResponseComplete","requestURI":"/api/v1/services?allowWatchBookmarks=true&labelSelector=%21service.kubernetes.io%2Fservice-proxy-name&resourceVersion=6628581&timeout=8m29s&timeoutSeconds=509&watch=true","verb":"watch","user":{"username":"system:ovn-node:master-2","groups":["system:ovn-nodes","system:authenticated"]},"sourceIPs":["10.20.180.130"],"userAgent":"master-2/ovnkube@6a95cb6b312c (linux/ppc64le) kubernetes/v0.27.4","objectRef":{"resource":"services","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:14:01.042787Z","stageTimestamp":"2025-06-10T15:22:30.044259Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"openshift-ovn-kubernetes-node-identity-limited\" of ClusterRole \"openshift-ovn-kubernetes-node-limited\" to Group \"system:ovn-nodes\""},"@timestamp":"2025-06-10T15:14:01.042787Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:30.220208+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":1366,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"OTMzM2M0OGMtODEwYS00M2U2LWFmNWMtZmM1ZWIxMzExZWYx","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"NGYzMTQ5MmUtYWI5YS00YzIwLTkwNDUtMTg5ZDQwZTRkMjU0","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"0c2b9c3a-549e-4650-9342-b643f6ea3359","stage":"ResponseStarted","requestURI":"/api/v1/services?allowWatchBookmarks=true&labelSelector=%21service.kubernetes.io%2Fservice-proxy-name&resourceVersion=6632510&timeout=7m21s&timeoutSeconds=441&watch=true","verb":"watch","user":{"username":"system:ovn-node:master-2","groups":["system:ovn-nodes","system:authenticated"]},"sourceIPs":["10.20.180.130"],"userAgent":"master-2/ovnkube@6a95cb6b312c (linux/ppc64le) kubernetes/v0.27.4","objectRef":{"resource":"services","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:22:30.045463Z","stageTimestamp":"2025-06-10T15:22:30.046397Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"openshift-ovn-kubernetes-node-identity-limited\" of ClusterRole \"openshift-ovn-kubernetes-node-limited\" to Group \"system:ovn-nodes\""},"@timestamp":"2025-06-10T15:22:30.045463Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:30.220256+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":1367,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"NGYzMTQ5MmUtYWI5YS00YzIwLTkwNDUtMTg5ZDQwZTRkMjU0","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"MzRhOWE0NzMtNTAwNS00MzcwLThkYWQtM2Y2NmNkOTcxOWU4","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"5628db75-4c1b-4cf3-9962-40054dc5371f","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1/clusterroles/multus-ancillary-tools?fieldManager=cluster-network-operator%2Foperconfig&force=true","verb":"patch","user":{"username":"system:serviceaccount:openshift-network-operator:default","uid":"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf","groups":["system:serviceaccounts","system:serviceaccounts:openshift-network-operator","system:authenticated"],"extra":{"authentication.kubernetes.io/pod-name":["network-operator-66dd79c745-wpcrp"],"authentication.kubernetes.io/pod-uid":["3b8d5f24-5371-4560-8459-5fe4adce33c7"]}},"sourceIPs":["10.20.180.130"],"userAgent":"cluster-network-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format","objectRef":{"resource":"clusterroles","name":"multus-ancillary-tools","apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:22:30.138170Z","stageTimestamp":"2025-06-10T15:22:30.143010Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"default-account-cluster-network-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"default/openshift-network-operator\""},"@timestamp":"2025-06-10T15:22:30.138170Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-0","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.83","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:30.220304+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":1368,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"MzRhOWE0NzMtNTAwNS00MzcwLThkYWQtM2Y2NmNkOTcxOWU4","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"ZjgyZGIxYTctMzk1NS00MjZlLWIwYjctYjVhZWFhM2U5Y2Yx","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"a6cf6512-0e75-400b-85cf-21c278d29e92","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-monitoring/secrets?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dthanos-querier-kube-rbac-proxy-metrics&resourceVersion=6628283&timeout=8m20s&timeoutSeconds=500&watch=true","verb":"watch","user":{"username":"system:node:worker-1","groups":["system:nodes","system:authenticated"]},"sourceIPs":["10.20.180.130"],"userAgent":"kubelet/v1.27.16+03a907c (linux/ppc64le) kubernetes/994a6d8","objectRef":{"resource":"secrets","namespace":"openshift-monitoring","name":"thanos-querier-kube-rbac-proxy-metrics","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:13:49.032180Z","stageTimestamp":"2025-06-10T15:22:09.036149Z","annotations":{"authorization.k8s.io/decision":"allow"},"@timestamp":"2025-06-10T15:13:49.032180Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:09.663906+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":25432,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"ZjgyZGIxYTctMzk1NS00MjZlLWIwYjctYjVhZWFhM2U5Y2Yx","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"M2U3N2M0MzktODU5Yy00MGMxLTg1NjMtNmFlZTViZDFiMWZh","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"c26752b2-5241-414f-b07b-962373e856b6","stage":"ResponseStarted","requestURI":"/api/v1/namespaces/openshift-monitoring/secrets?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dthanos-querier-kube-rbac-proxy-metrics&resourceVersion=6632417&timeout=8m44s&timeoutSeconds=524&watch=true","verb":"watch","user":{"username":"system:node:worker-1","groups":["system:nodes","system:authenticated"]},"sourceIPs":["10.20.180.130"],"userAgent":"kubelet/v1.27.16+03a907c (linux/ppc64le) kubernetes/994a6d8","objectRef":{"resource":"secrets","namespace":"openshift-monitoring","name":"thanos-querier-kube-rbac-proxy-metrics","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:22:09.037442Z","stageTimestamp":"2025-06-10T15:22:09.038429Z","annotations":{"authorization.k8s.io/decision":"allow"},"@timestamp":"2025-06-10T15:22:09.037442Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:09.664021+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":25433,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"M2U3N2M0MzktODU5Yy00MGMxLTg1NjMtNmFlZTViZDFiMWZh","log_type":"audit"}},{"_index":"audit-write","_type":"_doc","_id":"ZGJkYjUwOGEtYzYxOC00ODJhLTkyNzctMWZiNjk3Mjk0MWM2","_score":1.06533145E-4,"_source":{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"ca161f4d-f10f-46b1-af4d-7c37baae4d54","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/openshift-config-managed/configmaps?allowWatchBookmarks=true&fieldSelector=metadata.name%3Doauth-serving-cert&resourceVersion=6628974&timeout=7m11s&timeoutSeconds=431&watch=true","verb":"watch","user":{"username":"system:serviceaccount:openshift-monitoring:thanos-querier","uid":"61b54bd3-e34d-4666-8040-a0227bee3c85","groups":["system:serviceaccounts","system:serviceaccounts:openshift-monitoring","system:authenticated"],"extra":{"authentication.kubernetes.io/pod-name":["thanos-querier-6c98ff5cb-sj5kg"],"authentication.kubernetes.io/pod-uid":["66da6343-5a0f-4d62-96d8-d1961ac155b1"]}},"sourceIPs":["10.20.180.42"],"userAgent":"oauth-proxy/v0.0.0 (linux/ppc64le) kubernetes/$Format","objectRef":{"resource":"configmaps","namespace":"openshift-config-managed","name":"oauth-serving-cert","apiVersion":"v1"},"responseStatus":{"code":200},"requestReceivedTimestamp":"2025-06-10T15:14:58.067202Z","stageTimestamp":"2025-06-10T15:22:09.071057Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"system:openshift:oauth-servercert-trust/openshift-config-managed\" of Role \"system:openshift:oauth-servercert-trust\" to Group \"system:authenticated\""},"@timestamp":"2025-06-10T15:14:58.067202Z","k8s_audit_level":"Metadata","message":null,"hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:22:09.664083+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":25434,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"}},"viaq_msg_id":"ZGJkYjUwOGEtYzYxOC00ODJhLTkyNzctMWZiNjk3Mjk0MWM2","log_type":"audit"}}]}}
```





Infrastructure logs:
```
{"_index":"infra-write","_type":"_doc","_id":"ZDE3MGI0M2YtMDc1ZC00NmVlLTljZTEtODY2NGQ1MGNmOWU2","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-03T19:16:45.479452657+00:00","message":"image-registry.openshift-image-registry.svc.cluster.local:5000","docker":{"container_id":"393bfb5bc784e57e85fb09c40809436309aaf51b0dbe208e4035629ca4302328"},"kubernetes":{"container_name":"node-ca","namespace_name":"openshift-image-registry","pod_name":"node-ca-4rv4h","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","container_image_id":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","pod_id":"a7c7e30f-8d53-4bb2-9079-bb13e4b11848","pod_ip":"10.20.180.149","host":"worker-1","master_url":"https://kubernetes.default.svc","namespace_id":"5e5c9b6c-aa98-4662-bda9-56637ce3ed11","namespace_labels":{"kubernetes_io_metadata_name":"openshift-image-registry","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["controller-revision-hash=5cdcdb6b7f","name=node-ca","pod-template-generation=1"]},"level":"unknown","hostname":"worker-1","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.149","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:15.095584+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5456,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"ZDE3MGI0M2YtMDc1ZC00NmVlLTljZTEtODY2NGQ1MGNmOWU2","log_type":"infrastructure"}},{"_index":"infra-write","_type":"_doc","_id":"N2RmYzNhODItNjk2ZC00NjdiLWE5YTktMGRlNzkzYmJiMDcz","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-10T14:24:25.891977607+00:00","message":"I0610 14:24:25.891931       1 sync_worker.go:1002] Done syncing for role \"openshift-cluster-storage-operator/csi-snapshot-controller-operator-role\" (328 of 860)","docker":{"container_id":"82f6a202261cb49cadedfd3f0d29f649d6e84e8ac884e2b6b24eb27a86b09d37"},"kubernetes":{"container_name":"cluster-version-operator","namespace_name":"openshift-cluster-version","pod_name":"cluster-version-operator-7b7cb8c688-j5xgp","container_image":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","container_image_id":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","pod_id":"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb","pod_ip":"10.20.180.171","host":"master-2","master_url":"https://kubernetes.default.svc","namespace_id":"f8175223-1b5b-464b-b70c-dbba088618b2","namespace_labels":{"kubernetes_io_metadata_name":"openshift-cluster-version","name":"openshift-cluster-version","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["k8s-app=cluster-version-operator","pod-template-hash=7b7cb8c688"]},"level":"info","hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:10.820926+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5955,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"N2RmYzNhODItNjk2ZC00NjdiLWE5YTktMGRlNzkzYmJiMDcz","log_type":"infrastructure"}},{"_index":"infra-write","_type":"_doc","_id":"MzI1ZDRlNzctZmJmYy00NjUyLWJiMWYtZmJlZjMxN2JlN2E5","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-03T19:17:45.489079705+00:00","message":"image-registry.openshift-image-registry.svc..5000","docker":{"container_id":"393bfb5bc784e57e85fb09c40809436309aaf51b0dbe208e4035629ca4302328"},"kubernetes":{"container_name":"node-ca","namespace_name":"openshift-image-registry","pod_name":"node-ca-4rv4h","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","container_image_id":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","pod_id":"a7c7e30f-8d53-4bb2-9079-bb13e4b11848","pod_ip":"10.20.180.149","host":"worker-1","master_url":"https://kubernetes.default.svc","namespace_id":"5e5c9b6c-aa98-4662-bda9-56637ce3ed11","namespace_labels":{"kubernetes_io_metadata_name":"openshift-image-registry","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["controller-revision-hash=5cdcdb6b7f","name=node-ca","pod-template-generation=1"]},"level":"unknown","hostname":"worker-1","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.149","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:15.095895+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5458,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"MzI1ZDRlNzctZmJmYy00NjUyLWJiMWYtZmJlZjMxN2JlN2E5","log_type":"infrastructure"}},{"_index":"infra-write","_type":"_doc","_id":"NGFiNzQ2ZWEtZTM2My00YTBlLTljMGEtY2QyYzE5YWE0N2Vm","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-10T14:24:25.939019789+00:00","message":"I0610 14:24:25.938976       1 sync_worker.go:1002] Done syncing for rolebinding \"openshift-operator-lifecycle-manager/operator-lifecycle-manager-metrics\" (837 of 860)","docker":{"container_id":"82f6a202261cb49cadedfd3f0d29f649d6e84e8ac884e2b6b24eb27a86b09d37"},"kubernetes":{"container_name":"cluster-version-operator","namespace_name":"openshift-cluster-version","pod_name":"cluster-version-operator-7b7cb8c688-j5xgp","container_image":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","container_image_id":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","pod_id":"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb","pod_ip":"10.20.180.171","host":"master-2","master_url":"https://kubernetes.default.svc","namespace_id":"f8175223-1b5b-464b-b70c-dbba088618b2","namespace_labels":{"kubernetes_io_metadata_name":"openshift-cluster-version","name":"openshift-cluster-version","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["k8s-app=cluster-version-operator","pod-template-hash=7b7cb8c688"]},"level":"info","hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:10.821953+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5957,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"NGFiNzQ2ZWEtZTM2My00YTBlLTljMGEtY2QyYzE5YWE0N2Vm","log_type":"infrastructure"}},{"_index":"infra-write","_type":"_doc","_id":"NTVjMzc1ZmQtYmEyOC00M2M3LTkyZGYtNTc3MjM5ODhjNDdm","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-03T19:17:45.499966403+00:00","message":"image-registry.openshift-image-registry.svc.cluster.local:5000","docker":{"container_id":"393bfb5bc784e57e85fb09c40809436309aaf51b0dbe208e4035629ca4302328"},"kubernetes":{"container_name":"node-ca","namespace_name":"openshift-image-registry","pod_name":"node-ca-4rv4h","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","container_image_id":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6bef756805c24f48eeb2308cbdafa348f91e6dfe6f7500df5bbacdaf6dd99eb9","pod_id":"a7c7e30f-8d53-4bb2-9079-bb13e4b11848","pod_ip":"10.20.180.149","host":"worker-1","master_url":"https://kubernetes.default.svc","namespace_id":"5e5c9b6c-aa98-4662-bda9-56637ce3ed11","namespace_labels":{"kubernetes_io_metadata_name":"openshift-image-registry","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["controller-revision-hash=5cdcdb6b7f","name=node-ca","pod-template-generation=1"]},"level":"unknown","hostname":"worker-1","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.149","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:15.096239+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5460,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"NTVjMzc1ZmQtYmEyOC00M2M3LTkyZGYtNTc3MjM5ODhjNDdm","log_type":"infrastructure"}},{"_index":"infra-write","_type":"_doc","_id":"NGFlNjdkODQtZTNjYi00ZmI2LTk1YjktNWI5ODQwYTFkNGE3","_score":3.7367845E-6,"_source":{"@timestamp":"2025-06-10T14:24:25.989822432+00:00","message":"I0610 14:24:25.989769       1 sync_worker.go:1002] Done syncing for clusterrole \"system:openshift:aggregate-snapshots-to-admin\" (329 of 860)","docker":{"container_id":"82f6a202261cb49cadedfd3f0d29f649d6e84e8ac884e2b6b24eb27a86b09d37"},"kubernetes":{"container_name":"cluster-version-operator","namespace_name":"openshift-cluster-version","pod_name":"cluster-version-operator-7b7cb8c688-j5xgp","container_image":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","container_image_id":"quay.io/openshift-release-dev/ocp-release@sha256:63a5e8ad466cbd0c0f02cda0a9d422f218297b3f7c4f9aded9a5d3b4b388629d","pod_id":"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb","pod_ip":"10.20.180.171","host":"master-2","master_url":"https://kubernetes.default.svc","namespace_id":"f8175223-1b5b-464b-b70c-dbba088618b2","namespace_labels":{"kubernetes_io_metadata_name":"openshift-cluster-version","name":"openshift-cluster-version","openshift_io_cluster-monitoring":"true","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"flat_labels":["k8s-app=cluster-version-operator","pod-template-hash=7b7cb8c688"]},"level":"info","hostname":"master-2","pipeline_metadata":{"collector":{"ipaddr4":"10.20.180.171","inputname":"fluent-plugin-systemd","name":"fluentd","received_at":"2025-06-10T15:21:10.822483+00:00","version":"1.16.2 1.6.0"}},"openshift":{"sequence":5959,"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"}},"viaq_msg_id":"NGFlNjdkODQtZTNjYi00ZmI2LTk1YjktNWI5ODQwYTFkNGE3","log_type":"infrastructure"}}]}}
```





Kafka:


Audit logs:
```
{"@timestamp":"2025-06-10T13:14:04.253770363Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"default-account-cluster-network-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"default/openshift-network-operator\""},"apiVersion":"audit.k8s.io/v1","auditID":"be12fe42-442f-4081-8887-43f17e07d215","file":"/var/log/kube-apiserver/audit.log","hostname":"master-0","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiGroup":"config.openshift.io","apiVersion":"v1","resource":"proxies"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":31114},"requestReceivedTimestamp":"2025-06-10T13:06:14.235332Z","requestURI":"/apis/config.openshift.io/v1/proxies?allowWatchBookmarks=true&resourceVersion=6576326&timeoutSeconds=470&watch=true","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.20.180.130"],"source_type":"file","stage":"ResponseComplete","stageTimestamp":"2025-06-10T13:14:04.238880Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["network-operator-66dd79c745-wpcrp"],"authentication.kubernetes.io/pod-uid":["3b8d5f24-5371-4560-8459-5fe4adce33c7"]},"groups":["system:serviceaccounts","system:serviceaccounts:openshift-network-operator","system:authenticated"],"uid":"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf","username":"system:serviceaccount:openshift-network-operator:default"},"userAgent":"Go-http-client/2.0","verb":"watch"}
{"@timestamp":"2025-06-10T13:14:04.253779990Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"default-account-cluster-network-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"default/openshift-network-operator\""},"apiVersion":"audit.k8s.io/v1","auditID":"4aac390c-f201-48a3-937e-922e3a24c43a","file":"/var/log/kube-apiserver/audit.log","hostname":"master-0","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiGroup":"config.openshift.io","apiVersion":"v1","resource":"proxies"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":31115},"requestReceivedTimestamp":"2025-06-10T13:14:04.240062Z","requestURI":"/apis/config.openshift.io/v1/proxies?allowWatchBookmarks=true&resourceVersion=6579945&timeoutSeconds=586&watch=true","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.20.180.130"],"source_type":"file","stage":"ResponseStarted","stageTimestamp":"2025-06-10T13:14:04.240446Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["network-operator-66dd79c745-wpcrp"],"authentication.kubernetes.io/pod-uid":["3b8d5f24-5371-4560-8459-5fe4adce33c7"]},"groups":["system:serviceaccounts","system:serviceaccounts:openshift-network-operator","system:authenticated"],"uid":"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf","username":"system:serviceaccount:openshift-network-operator:default"},"userAgent":"Go-http-client/2.0","verb":"watch"}
{"@timestamp":"2025-06-10T13:14:04.262839618Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"leader-locking-nfs-client-provisioner/nfs-provisioner\" of Role \"leader-locking-nfs-client-provisioner\" to ServiceAccount \"nfs-client-provisioner/nfs-provisioner\""},"apiVersion":"audit.k8s.io/v1","auditID":"1a4efbd4-8e2c-43af-af92-8e061221144e","file":"/var/log/kube-apiserver/audit.log","hostname":"master-2","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiVersion":"v1","name":"nfs-storage","namespace":"nfs-provisioner","resource":"endpoints"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":134376},"requestReceivedTimestamp":"2025-06-10T13:14:04.249818Z","requestURI":"/api/v1/namespaces/nfs-provisioner/endpoints/nfs-storage","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.20.180.42"],"source_type":"file","stage":"ResponseComplete","stageTimestamp":"2025-06-10T13:14:04.256069Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["nfs-client-provisioner-864cb9dc7-wzkxt"],"authentication.kubernetes.io/pod-uid":["244e8560-8d3d-452d-a26e-8c6e556cd1bd"]},"groups":["system:serviceaccounts","system:serviceaccounts:nfs-provisioner","system:authenticated"],"uid":"84d6a973-48d7-465a-b157-3445eebf8789","username":"system:serviceaccount:nfs-provisioner:nfs-client-provisioner"},"userAgent":"nfs-subdir-external-provisioner/v0.0.0 (linux/ppc64le) kubernetes/$Format","verb":"get"}
{"@timestamp":"2025-06-10T13:14:04.262871733Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by RoleBinding \"leader-locking-nfs-client-provisioner/nfs-provisioner\" of Role \"leader-locking-nfs-client-provisioner\" to ServiceAccount \"nfs-client-provisioner/nfs-provisioner\""},"apiVersion":"audit.k8s.io/v1","auditID":"1f8eb237-c100-4ee0-bdca-cb1ebec08c7a","file":"/var/log/kube-apiserver/audit.log","hostname":"master-2","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiVersion":"v1","name":"nfs-storage","namespace":"nfs-provisioner","resource":"endpoints","resourceVersion":"6579966","uid":"ebaf01b2-1d1e-4e19-b8c7-12282a308997"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":134377},"requestReceivedTimestamp":"2025-06-10T13:14:04.257147Z","requestURI":"/api/v1/namespaces/nfs-provisioner/endpoints/nfs-storage","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.20.180.42"],"source_type":"file","stage":"ResponseComplete","stageTimestamp":"2025-06-10T13:14:04.262131Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["nfs-client-provisioner-864cb9dc7-wzkxt"],"authentication.kubernetes.io/pod-uid":["244e8560-8d3d-452d-a26e-8c6e556cd1bd"]},"groups":["system:serviceaccounts","system:serviceaccounts:nfs-provisioner","system:authenticated"],"uid":"84d6a973-48d7-465a-b157-3445eebf8789","username":"system:serviceaccount:nfs-provisioner:nfs-client-provisioner"},"userAgent":"nfs-subdir-external-provisioner/v0.0.0 (linux/ppc64le) kubernetes/$Format","verb":"update"}
{"@timestamp":"2025-06-10T13:14:04.279875625Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"olm-operator-binding-openshift-operator-lifecycle-manager\" of ClusterRole \"system:controller:operator-lifecycle-manager\" to ServiceAccount \"olm-operator-serviceaccount/openshift-operator-lifecycle-manager\""},"apiVersion":"audit.k8s.io/v1","auditID":"dfa96dd1-3ce6-4450-9a30-08bf5993b5e2","file":"/var/log/kube-apiserver/audit.log","hostname":"master-2","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiGroup":"operators.coreos.com","apiVersion":"v1alpha1","name":"cluster-logging.v5.8.21","namespace":"openshift-etcd-operator","resource":"clusterserviceversions","resourceVersion":"6466088","uid":"6e581b4b-f81a-4f19-b743-e25d116cacf9"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":134378},"requestReceivedTimestamp":"2025-06-10T13:14:04.247642Z","requestURI":"/apis/operators.coreos.com/v1alpha1/namespaces/openshift-etcd-operator/clusterserviceversions/cluster-logging.v5.8.21","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.130.0.172"],"source_type":"file","stage":"ResponseComplete","stageTimestamp":"2025-06-10T13:14:04.276513Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["olm-operator-7c59f44d4-wczs9"],"authentication.kubernetes.io/pod-uid":["e5225720-0400-4f4c-8bd5-08aab5b3640f"]},"groups":["system:serviceaccounts","system:serviceaccounts:openshift-operator-lifecycle-manager","system:authenticated"],"uid":"95ace149-ea3b-4514-85dd-adc4333fd9a4","username":"system:serviceaccount:openshift-operator-lifecycle-manager:olm-operator-serviceaccount"},"userAgent":"olm/v0.0.0 (linux/ppc64le) kubernetes/$Format","verb":"update"}
{"@timestamp":"2025-06-10T13:14:04.321467837Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"default-account-cluster-network-operator\" of ClusterRole \"cluster-admin\" to ServiceAccount \"default/openshift-network-operator\""},"apiVersion":"audit.k8s.io/v1","auditID":"4061d0c0-64ba-4cd0-ad1c-cb1bbfb02021","file":"/var/log/kube-apiserver/audit.log","hostname":"master-0","k8s_audit_level":"Metadata","kind":"Event","level":"Metadata","log_type":"audit","objectRef":{"apiGroup":"rbac.authorization.k8s.io","apiVersion":"v1","name":"system:openshift:scc:hostnetwork-v2","namespace":"openshift-network-node-identity","resource":"rolebindings"},"openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-audit"},"sequence":31116},"requestReceivedTimestamp":"2025-06-10T13:14:04.301641Z","requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/openshift-network-node-identity/rolebindings/system:openshift:scc:hostnetwork-v2","responseStatus":{"code":200,"metadata":{}},"sourceIPs":["10.20.180.130"],"source_type":"file","stage":"ResponseComplete","stageTimestamp":"2025-06-10T13:14:04.303879Z","tag":".k8s-audit.log","user":{"extra":{"authentication.kubernetes.io/pod-name":["network-operator-66dd79c745-wpcrp"],"authentication.kubernetes.io/pod-uid":["3b8d5f24-5371-4560-8459-5fe4adce33c7"]},"groups":["system:serviceaccounts","system:serviceaccounts:openshift-network-operator","system:authenticated"],"uid":"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf","username":"system:serviceaccount:openshift-network-operator:default"},"userAgent":"cluster-network-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format","verb":"get"}
```





Infrastructure logs:
```
{"@timestamp":"2025-06-10T13:14:06.510879848Z","file":"/var/log/pods/openshift-network-operator_network-operator-66dd79c745-wpcrp_3b8d5f24-5371-4560-8459-5fe4adce33c7/network-operator/0.log","hostname":"master-2","kubernetes":{"container_id":"cri-o://adee30d9435ce2254b09fc9a6561d3b124a2aea0ec9897849377cd2e9230ee6a","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81b6853a61710ba8a1984c522d25817cd9f61c015809236511fe1bbc9a421f79","container_name":"network-operator","labels":{"name":"network-operator","pod-template-hash":"66dd79c745"},"namespace_id":"d7801a41-6836-4a42-bcf4-fc32749d4dae","namespace_labels":{"kubernetes_io_metadata_name":"openshift-network-operator","name":"openshift-network-operator","olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82":"","openshift_io_cluster-monitoring":"true","openshift_io_run-level":"0","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"namespace_name":"openshift-network-operator","pod_id":"3b8d5f24-5371-4560-8459-5fe4adce33c7","pod_ip":"10.20.180.171","pod_name":"network-operator-66dd79c745-wpcrp","pod_owner":"ReplicaSet/network-operator-66dd79c745"},"level":"info","log_type":"infrastructure","message":"I0610 13:14:06.510816       1 log.go:194] Apply / Create of (monitoring.coreos.com/v1, Kind=PrometheusRule) openshift-network-operator/openshift-network-operator-ipsec-rules was successful","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"},"sequence":3622}}
{"@timestamp":"2025-06-10T13:14:06.529880906Z","file":"/var/log/pods/openshift-network-operator_network-operator-66dd79c745-wpcrp_3b8d5f24-5371-4560-8459-5fe4adce33c7/network-operator/0.log","hostname":"master-2","kubernetes":{"container_id":"cri-o://adee30d9435ce2254b09fc9a6561d3b124a2aea0ec9897849377cd2e9230ee6a","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81b6853a61710ba8a1984c522d25817cd9f61c015809236511fe1bbc9a421f79","container_name":"network-operator","labels":{"name":"network-operator","pod-template-hash":"66dd79c745"},"namespace_id":"d7801a41-6836-4a42-bcf4-fc32749d4dae","namespace_labels":{"kubernetes_io_metadata_name":"openshift-network-operator","name":"openshift-network-operator","olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82":"","openshift_io_cluster-monitoring":"true","openshift_io_run-level":"0","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"namespace_name":"openshift-network-operator","pod_id":"3b8d5f24-5371-4560-8459-5fe4adce33c7","pod_ip":"10.20.180.171","pod_name":"network-operator-66dd79c745-wpcrp","pod_owner":"ReplicaSet/network-operator-66dd79c745"},"level":"info","log_type":"infrastructure","message":"I0610 13:14:06.529841       1 log.go:194] Operconfig Controller complete","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"},"sequence":3623}}
{"@timestamp":"2025-06-10T13:14:06.529947821Z","file":"/var/log/pods/openshift-network-operator_network-operator-66dd79c745-wpcrp_3b8d5f24-5371-4560-8459-5fe4adce33c7/network-operator/0.log","hostname":"master-2","kubernetes":{"container_id":"cri-o://adee30d9435ce2254b09fc9a6561d3b124a2aea0ec9897849377cd2e9230ee6a","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81b6853a61710ba8a1984c522d25817cd9f61c015809236511fe1bbc9a421f79","container_name":"network-operator","labels":{"name":"network-operator","pod-template-hash":"66dd79c745"},"namespace_id":"d7801a41-6836-4a42-bcf4-fc32749d4dae","namespace_labels":{"kubernetes_io_metadata_name":"openshift-network-operator","name":"openshift-network-operator","olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82":"","openshift_io_cluster-monitoring":"true","openshift_io_run-level":"0","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"namespace_name":"openshift-network-operator","pod_id":"3b8d5f24-5371-4560-8459-5fe4adce33c7","pod_ip":"10.20.180.171","pod_name":"network-operator-66dd79c745-wpcrp","pod_owner":"ReplicaSet/network-operator-66dd79c745"},"level":"info","log_type":"infrastructure","message":"I0610 13:14:06.529909       1 log.go:194] Reconciling Network.operator.openshift.io cluster","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"},"sequence":3624}}
{"@timestamp":"2025-06-10T13:14:06.581263223Z","file":"/var/log/pods/openshift-network-operator_network-operator-66dd79c745-wpcrp_3b8d5f24-5371-4560-8459-5fe4adce33c7/network-operator/0.log","hostname":"master-2","kubernetes":{"container_id":"cri-o://adee30d9435ce2254b09fc9a6561d3b124a2aea0ec9897849377cd2e9230ee6a","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81b6853a61710ba8a1984c522d25817cd9f61c015809236511fe1bbc9a421f79","container_name":"network-operator","labels":{"name":"network-operator","pod-template-hash":"66dd79c745"},"namespace_id":"d7801a41-6836-4a42-bcf4-fc32749d4dae","namespace_labels":{"kubernetes_io_metadata_name":"openshift-network-operator","name":"openshift-network-operator","olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82":"","openshift_io_cluster-monitoring":"true","openshift_io_run-level":"0","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"namespace_name":"openshift-network-operator","pod_id":"3b8d5f24-5371-4560-8459-5fe4adce33c7","pod_ip":"10.20.180.171","pod_name":"network-operator-66dd79c745-wpcrp","pod_owner":"ReplicaSet/network-operator-66dd79c745"},"level":"info","log_type":"infrastructure","message":"I0610 13:14:06.581219       1 ovn_kubernetes.go:896] For Label network.operator.openshift.io/dpu-host=, the list of nodes are []","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"},"sequence":3625}}
{"@timestamp":"2025-06-10T13:14:06.586152764Z","file":"/var/log/pods/openshift-network-operator_network-operator-66dd79c745-wpcrp_3b8d5f24-5371-4560-8459-5fe4adce33c7/network-operator/0.log","hostname":"master-2","kubernetes":{"container_id":"cri-o://adee30d9435ce2254b09fc9a6561d3b124a2aea0ec9897849377cd2e9230ee6a","container_image":"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81b6853a61710ba8a1984c522d25817cd9f61c015809236511fe1bbc9a421f79","container_name":"network-operator","labels":{"name":"network-operator","pod-template-hash":"66dd79c745"},"namespace_id":"d7801a41-6836-4a42-bcf4-fc32749d4dae","namespace_labels":{"kubernetes_io_metadata_name":"openshift-network-operator","name":"openshift-network-operator","olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82":"","openshift_io_cluster-monitoring":"true","openshift_io_run-level":"0","pod-security_kubernetes_io_audit":"privileged","pod-security_kubernetes_io_enforce":"privileged","pod-security_kubernetes_io_warn":"privileged"},"namespace_name":"openshift-network-operator","pod_id":"3b8d5f24-5371-4560-8459-5fe4adce33c7","pod_ip":"10.20.180.171","pod_name":"network-operator-66dd79c745-wpcrp","pod_owner":"ReplicaSet/network-operator-66dd79c745"},"level":"info","log_type":"infrastructure","message":"I0610 13:14:06.586127       1 ovn_kubernetes.go:896] For Label network.operator.openshift.io/dpu=, the list of nodes are []","openshift":{"cluster_id":"b4fd03ae-ded6-4258-95cd-da78c546f8bc","labels":{"logs":"5.8_414-infrastructure"},"sequence":3626}}
```





Loki:



Audit logs:
```
{"ts":"2025-06-10T15:25:48.030042Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"0b1ab23a-3882-4d60-8368-59f67b9ead9c\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-node-tuning:tuned\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"clusterrolebindings\",\"name\":\"cluster-node-tuning:tuned\",\"apiGroup\":\"rbac.authorization.k8s.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:48.030042Z\",\"stageTimestamp\":\"2025-06-10T15:25:48.031961Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:48.030042Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643629+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74905,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"NzAxYmNjOWEtNzdjYi00ZDk3LTkxMmUtNWFhOGNhYzBiNDFl\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.980851Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"a45d9950-a94a-46a6-9fa2-0fc4254c50de\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/rbac.authorization.k8s.io/v1/namespaces/openshift-console/rolebindings/prometheus-k8s\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"rolebindings\",\"namespace\":\"openshift-console\",\"name\":\"prometheus-k8s\",\"apiGroup\":\"rbac.authorization.k8s.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.980851Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.982789Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.980851Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643583+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74904,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"ZWIwY2RkODktN2YyZS00MzQ3LWFiM2QtMzVmNzc2ZGNhNDM0\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.929558Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"7118c48c-45b9-43d0-938b-9e015d08b611\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-node-tuning:tuned\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"clusterroles\",\"name\":\"cluster-node-tuning:tuned\",\"apiGroup\":\"rbac.authorization.k8s.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.929558Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.932102Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.929558Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643537+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74903,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"ZTAyNTU1YjAtMGIzMi00YzhjLWEzOTUtM2NhZDRlZTM1MTlh\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.880098Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"9492b6ac-0baf-4a9f-b26c-031c1570ae4f\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/rbac.authorization.k8s.io/v1/namespaces/openshift-console/roles/prometheus-k8s\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"roles\",\"namespace\":\"openshift-console\",\"name\":\"prometheus-k8s\",\"apiGroup\":\"rbac.authorization.k8s.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.880098Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.881999Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.880098Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643490+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74902,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"MjRlZGU5NWQtMDM5NS00NGVlLThmNGItZGZkNjNiNTRjM2Q2\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.831701Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"a1006b1a-422f-497e-9f42-7757b3e75fa0\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/openshift-network-diagnostics/services/network-check-target?fieldManager=cluster-network-operator%2Foperconfig\u0026force=true\",\"verb\":\"patch\",\"user\":{\"username\":\"system:serviceaccount:openshift-network-operator:default\",\"uid\":\"0d2ab1ae-81f0-4c65-9b89-9f27868fc9bf\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-network-operator\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"network-operator-66dd79c745-wpcrp\"],\"authentication.kubernetes.io/pod-uid\":[\"3b8d5f24-5371-4560-8459-5fe4adce33c7\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-network-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"services\",\"namespace\":\"openshift-network-diagnostics\",\"name\":\"network-check-target\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.831701Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.840639Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"default-account-cluster-network-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-network-operator\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.831701Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643443+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74901,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"MDZmY2Y3ZmItOTE0NC00YTQwLTk2NzUtNDQ5OWQxYjcxODZi\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.829809Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"ff91a9ea-9148-4a59-baa4-31a2f689030e\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/api/v1/namespaces/openshift-cluster-node-tuning-operator/serviceaccounts/tuned\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"serviceaccounts\",\"namespace\":\"openshift-cluster-node-tuning-operator\",\"name\":\"tuned\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.829809Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.835475Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.829809Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643396+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74900,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"NGJlZmRjYzAtZjcyZi00NWIwLTkzYWUtNWM1N2Y0ZGRlOWJm\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.781137Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"9faa0541-7a41-425b-b858-b63a16d58670\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/cloudcredential.openshift.io/v1/namespaces/openshift-cloud-credential-operator/credentialsrequests/cloud-credential-operator-iam-ro\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"credentialsrequests\",\"namespace\":\"openshift-cloud-credential-operator\",\"name\":\"cloud-credential-operator-iam-ro\",\"apiGroup\":\"cloudcredential.openshift.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.781137Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.784620Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.781137Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643346+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74899,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"YmU2M2M0NzAtY2U5Ny00OWQ1LTkxNmYtNDE0MGEyMjQ5ZGI1\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.729689Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"01220ec0-be35-43f3-afb1-e5ae448721d7\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/cluster-node-tuning-operator\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"clusterrolebindings\",\"name\":\"cluster-node-tuning-operator\",\"apiGroup\":\"rbac.authorization.k8s.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.729689Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.732841Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.729689Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:48.643282+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74898,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"NmMyZjhhZTMtYTE5ZS00NTRjLWJkZmYtYWIwY2Y1NzAxMWYz\",\"log_type\":\"audit\"}"},{"ts":"2025-06-10T15:25:47.680178Z","line":"{\"kind\":\"Event\",\"apiVersion\":\"audit.k8s.io/v1\",\"level\":\"Metadata\",\"auditID\":\"cc351a55-dec2-40a8-ad5b-0633684ec45a\",\"stage\":\"ResponseComplete\",\"requestURI\":\"/apis/cloudcredential.openshift.io/v1/namespaces/openshift-cloud-credential-operator/credentialsrequests/cloud-credential-operator-gcp-ro-creds\",\"verb\":\"get\",\"user\":{\"username\":\"system:serviceaccount:openshift-cluster-version:default\",\"uid\":\"2c09cb9a-3922-4cda-8928-90f43363278a\",\"groups\":[\"system:serviceaccounts\",\"system:serviceaccounts:openshift-cluster-version\",\"system:authenticated\"],\"extra\":{\"authentication.kubernetes.io/pod-name\":[\"cluster-version-operator-7b7cb8c688-j5xgp\"],\"authentication.kubernetes.io/pod-uid\":[\"ebeba0ed-7e9c-495d-a6d7-fcf589f892eb\"]}},\"sourceIPs\":[\"10.20.180.130\"],\"userAgent\":\"cluster-version-operator/v0.0.0 (linux/ppc64le) kubernetes/$Format\",\"objectRef\":{\"resource\":\"credentialsrequests\",\"namespace\":\"openshift-cloud-credential-operator\",\"name\":\"cloud-credential-operator-gcp-ro-creds\",\"apiGroup\":\"cloudcredential.openshift.io\",\"apiVersion\":\"v1\"},\"responseStatus\":{\"metadata\":{},\"code\":200},\"requestReceivedTimestamp\":\"2025-06-10T15:25:47.680178Z\",\"stageTimestamp\":\"2025-06-10T15:25:47.682756Z\",\"annotations\":{\"authorization.k8s.io/decision\":\"allow\",\"authorization.k8s.io/reason\":\"RBAC: allowed by ClusterRoleBinding \\\"cluster-version-operator\\\" of ClusterRole \\\"cluster-admin\\\" to ServiceAccount \\\"default/openshift-cluster-version\\\"\"},\"@timestamp\":\"2025-06-10T15:25:47.680178Z\",\"k8s_audit_level\":\"Metadata\",\"message\":null,\"hostname\":\"master-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.83\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:25:47.720835+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":74895,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-audit\"}},\"viaq_msg_id\":\"NDI1N2E2OTQtNDRmMi00ZTQ4LWJmYTQtZGI0YzhhZThlMzUz\",\"log_type\":\"audit\"}"}]}],"stats":{"summary":{"bytesProcessedPerSecond":387562158,"linesProcessedPerSecond":212448,"totalBytesProcessed":21497080,"totalLinesProcessed":11784,"execTime":0.055467438,"queueTime":0.000039,"subqueries":0,"totalEntriesReturned":100,"splits":1,"shards":0},"querier":{"store":{"totalChunksRef":0,"totalChunksDownloaded":0,"chunksDownloadTime":0,"chunk":{"headChunkBytes":0,"headChunkLines":0,"decompressedBytes":0,"decompressedLines":0,"compressedBytes":0,"totalDuplicates":0}}},"ingester":{"totalReached":1,"totalChunksMatched":7,"totalBatches":1,"totalLinesSent":100,"store":{"totalChunksRef":0,"totalChunksDownloaded":0,"chunksDownloadTime":0,"chunk":{"headChunkBytes":750617,"headChunkLines":435,"decompressedBytes":20746463,"decompressedLines":11349,"compressedBytes":2102899,"totalDuplicates":0}}},"cache":{"chunk":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0},"index":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0},"result":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0}}}}
```





Infrastructure logs:
```
"entries":[{"ts":"2025-06-10T15:24:21.067517932Z","line":"{\"@timestamp\":\"2025-06-10T15:24:21.067517932+00:00\",\"message\":\"ts=2025-06-10T15:24:21.067Z caller=collector.go:169 level=error msg=\\\"collector failed\\\" name=fibrechannel duration_seconds=0.001165728 err=\\\"error obtaining FibreChannel class info: failed to read file \\\\\\\"/host/sys/class/fc_host/host1/symbolic_name\\\\\\\": open /host/sys/class/fc_host/host1/symbolic_name: no such file or directory\\\"\",\"docker\":{\"container_id\":\"1c983041a31b8d917aa3a1243bdcbb2a2a5705513e91552c240c8ca7bda9d150\"},\"kubernetes\":{\"container_name\":\"node-exporter\",\"namespace_name\":\"openshift-monitoring\",\"pod_name\":\"node-exporter-95tpr\",\"container_image\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"container_image_id\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"pod_id\":\"c845de5c-365c-4862-bde5-afe1539041a7\",\"pod_ip\":\"10.20.180.42\",\"host\":\"worker-0\",\"labels\":{\"app_kubernetes_io_component\":\"exporter\",\"app_kubernetes_io_managed-by\":\"cluster-monitoring-operator\",\"app_kubernetes_io_name\":\"node-exporter\",\"app_kubernetes_io_part-of\":\"openshift-monitoring\",\"app_kubernetes_io_version\":\"1.6.1\",\"controller-revision-hash\":\"dbc67c884\",\"pod-template-generation\":\"1\"},\"master_url\":\"https://kubernetes.default.svc\",\"namespace_id\":\"0b74b592-055a-4492-af31-74ee5140b3f6\",\"namespace_labels\":{\"kubernetes_io_metadata_name\":\"openshift-monitoring\",\"name\":\"openshift-monitoring\",\"network_openshift_io_policy-group\":\"monitoring\",\"olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82\":\"\",\"openshift_io_cluster-monitoring\":\"true\",\"pod-security_kubernetes_io_audit\":\"privileged\",\"pod-security_kubernetes_io_enforce\":\"privileged\",\"pod-security_kubernetes_io_warn\":\"privileged\"},\"flat_labels\":[\"app_kubernetes_io_component=exporter\",\"app_kubernetes_io_managed-by=cluster-monitoring-operator\",\"app_kubernetes_io_name=node-exporter\",\"app_kubernetes_io_part-of=openshift-monitoring\",\"app_kubernetes_io_version=1_6_1\",\"controller-revision-hash=dbc67c884\",\"pod-template-generation=1\"]},\"level\":\"error\",\"hostname\":\"worker-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.42\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:24:26.881522+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":13676,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-infrastructure\"}},\"viaq_msg_id\":\"MDEwNjZmZGQtZjc5Yy00OWM1LTlhZjEtNTBjMjE5ODhhNjI1\",\"log_type\":\"infrastructure\"}"},{"ts":"2025-06-10T15:24:17.426734616Z","line":"{\"@timestamp\":\"2025-06-10T15:24:17.426734616+00:00\",\"message\":\"ts=2025-06-10T15:24:17.426Z caller=collector.go:169 level=error msg=\\\"collector failed\\\" name=fibrechannel duration_seconds=0.001412174 err=\\\"error obtaining FibreChannel class info: failed to read file \\\\\\\"/host/sys/class/fc_host/host1/symbolic_name\\\\\\\": open /host/sys/class/fc_host/host1/symbolic_name: no such file or directory\\\"\",\"docker\":{\"container_id\":\"1c983041a31b8d917aa3a1243bdcbb2a2a5705513e91552c240c8ca7bda9d150\"},\"kubernetes\":{\"container_name\":\"node-exporter\",\"namespace_name\":\"openshift-monitoring\",\"pod_name\":\"node-exporter-95tpr\",\"container_image\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"container_image_id\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"pod_id\":\"c845de5c-365c-4862-bde5-afe1539041a7\",\"pod_ip\":\"10.20.180.42\",\"host\":\"worker-0\",\"labels\":{\"app_kubernetes_io_component\":\"exporter\",\"app_kubernetes_io_managed-by\":\"cluster-monitoring-operator\",\"app_kubernetes_io_name\":\"node-exporter\",\"app_kubernetes_io_part-of\":\"openshift-monitoring\",\"app_kubernetes_io_version\":\"1.6.1\",\"controller-revision-hash\":\"dbc67c884\",\"pod-template-generation\":\"1\"},\"master_url\":\"https://kubernetes.default.svc\",\"namespace_id\":\"0b74b592-055a-4492-af31-74ee5140b3f6\",\"namespace_labels\":{\"kubernetes_io_metadata_name\":\"openshift-monitoring\",\"name\":\"openshift-monitoring\",\"network_openshift_io_policy-group\":\"monitoring\",\"olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82\":\"\",\"openshift_io_cluster-monitoring\":\"true\",\"pod-security_kubernetes_io_audit\":\"privileged\",\"pod-security_kubernetes_io_enforce\":\"privileged\",\"pod-security_kubernetes_io_warn\":\"privileged\"},\"flat_labels\":[\"app_kubernetes_io_component=exporter\",\"app_kubernetes_io_managed-by=cluster-monitoring-operator\",\"app_kubernetes_io_name=node-exporter\",\"app_kubernetes_io_part-of=openshift-monitoring\",\"app_kubernetes_io_version=1_6_1\",\"controller-revision-hash=dbc67c884\",\"pod-template-generation=1\"]},\"level\":\"error\",\"hostname\":\"worker-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.42\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:24:26.881347+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":13675,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-infrastructure\"}},\"viaq_msg_id\":\"YzhjNjY1NWUtZjZlNC00NTg4LWFkNDItZDk0YzQ5MzNiNGYw\",\"log_type\":\"infrastructure\"}"},{"ts":"2025-06-10T15:24:06.068557186Z","line":"{\"@timestamp\":\"2025-06-10T15:24:06.068557186+00:00\",\"message\":\"ts=2025-06-10T15:24:06.068Z caller=collector.go:169 level=error msg=\\\"collector failed\\\" name=fibrechannel duration_seconds=0.000716379 err=\\\"error obtaining FibreChannel class info: failed to read file \\\\\\\"/host/sys/class/fc_host/host1/symbolic_name\\\\\\\": open /host/sys/class/fc_host/host1/symbolic_name: no such file or directory\\\"\",\"docker\":{\"container_id\":\"1c983041a31b8d917aa3a1243bdcbb2a2a5705513e91552c240c8ca7bda9d150\"},\"kubernetes\":{\"container_name\":\"node-exporter\",\"namespace_name\":\"openshift-monitoring\",\"pod_name\":\"node-exporter-95tpr\",\"container_image\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"container_image_id\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"pod_id\":\"c845de5c-365c-4862-bde5-afe1539041a7\",\"pod_ip\":\"10.20.180.42\",\"host\":\"worker-0\",\"labels\":{\"app_kubernetes_io_component\":\"exporter\",\"app_kubernetes_io_managed-by\":\"cluster-monitoring-operator\",\"app_kubernetes_io_name\":\"node-exporter\",\"app_kubernetes_io_part-of\":\"openshift-monitoring\",\"app_kubernetes_io_version\":\"1.6.1\",\"controller-revision-hash\":\"dbc67c884\",\"pod-template-generation\":\"1\"},\"master_url\":\"https://kubernetes.default.svc\",\"namespace_id\":\"0b74b592-055a-4492-af31-74ee5140b3f6\",\"namespace_labels\":{\"kubernetes_io_metadata_name\":\"openshift-monitoring\",\"name\":\"openshift-monitoring\",\"network_openshift_io_policy-group\":\"monitoring\",\"olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82\":\"\",\"openshift_io_cluster-monitoring\":\"true\",\"pod-security_kubernetes_io_audit\":\"privileged\",\"pod-security_kubernetes_io_enforce\":\"privileged\",\"pod-security_kubernetes_io_warn\":\"privileged\"},\"flat_labels\":[\"app_kubernetes_io_component=exporter\",\"app_kubernetes_io_managed-by=cluster-monitoring-operator\",\"app_kubernetes_io_name=node-exporter\",\"app_kubernetes_io_part-of=openshift-monitoring\",\"app_kubernetes_io_version=1_6_1\",\"controller-revision-hash=dbc67c884\",\"pod-template-generation=1\"]},\"level\":\"error\",\"hostname\":\"worker-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.42\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:24:26.881174+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":13674,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-infrastructure\"}},\"viaq_msg_id\":\"MTk3ZDllYWQtOWEwMS00N2MyLWI0Y2MtN2FhYmNjODg4ZTFh\",\"log_type\":\"infrastructure\"}"},{"ts":"2025-06-10T15:24:02.425572855Z","line":"{\"@timestamp\":\"2025-06-10T15:24:02.425572855+00:00\",\"message\":\"ts=2025-06-10T15:24:02.425Z caller=collector.go:169 level=error msg=\\\"collector failed\\\" name=fibrechannel duration_seconds=0.000567105 err=\\\"error obtaining FibreChannel class info: failed to read file \\\\\\\"/host/sys/class/fc_host/host1/symbolic_name\\\\\\\": open /host/sys/class/fc_host/host1/symbolic_name: no such file or directory\\\"\",\"docker\":{\"container_id\":\"1c983041a31b8d917aa3a1243bdcbb2a2a5705513e91552c240c8ca7bda9d150\"},\"kubernetes\":{\"container_name\":\"node-exporter\",\"namespace_name\":\"openshift-monitoring\",\"pod_name\":\"node-exporter-95tpr\",\"container_image\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"container_image_id\":\"quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:09ed229ac51d0974845b70eff5d1dbb2ed7fcbacef78d31b40301a2244da8221\",\"pod_id\":\"c845de5c-365c-4862-bde5-afe1539041a7\",\"pod_ip\":\"10.20.180.42\",\"host\":\"worker-0\",\"labels\":{\"app_kubernetes_io_component\":\"exporter\",\"app_kubernetes_io_managed-by\":\"cluster-monitoring-operator\",\"app_kubernetes_io_name\":\"node-exporter\",\"app_kubernetes_io_part-of\":\"openshift-monitoring\",\"app_kubernetes_io_version\":\"1.6.1\",\"controller-revision-hash\":\"dbc67c884\",\"pod-template-generation\":\"1\"},\"master_url\":\"https://kubernetes.default.svc\",\"namespace_id\":\"0b74b592-055a-4492-af31-74ee5140b3f6\",\"namespace_labels\":{\"kubernetes_io_metadata_name\":\"openshift-monitoring\",\"name\":\"openshift-monitoring\",\"network_openshift_io_policy-group\":\"monitoring\",\"olm_operatorgroup_uid_7596fac4-d65f-46fc-9664-e65676c4fb82\":\"\",\"openshift_io_cluster-monitoring\":\"true\",\"pod-security_kubernetes_io_audit\":\"privileged\",\"pod-security_kubernetes_io_enforce\":\"privileged\",\"pod-security_kubernetes_io_warn\":\"privileged\"},\"flat_labels\":[\"app_kubernetes_io_component=exporter\",\"app_kubernetes_io_managed-by=cluster-monitoring-operator\",\"app_kubernetes_io_name=node-exporter\",\"app_kubernetes_io_part-of=openshift-monitoring\",\"app_kubernetes_io_version=1_6_1\",\"controller-revision-hash=dbc67c884\",\"pod-template-generation=1\"]},\"level\":\"error\",\"hostname\":\"worker-0\",\"pipeline_metadata\":{\"collector\":{\"ipaddr4\":\"10.20.180.42\",\"inputname\":\"fluent-plugin-systemd\",\"name\":\"fluentd\",\"received_at\":\"2025-06-10T15:24:26.881001+00:00\",\"version\":\"1.16.2 1.6.0\"}},\"openshift\":{\"sequence\":13673,\"cluster_id\":\"b4fd03ae-ded6-4258-95cd-da78c546f8bc\",\"labels\":{\"logs\":\"5.8_414-infrastructure\"}},\"viaq_msg_id\":\"Nzk4NzNkZDUtYzhiMy00M2Q1LWJlOGEtMjRhM2Y5YWJkOTMz\",\"log_type\":\"infrastructure\"}"}]}],"stats":{"summary":{"bytesProcessedPerSecond":204705215,"linesProcessedPerSecond":99386,"totalBytesProcessed":4815560,"totalLinesProcessed":2338,"execTime":0.023524364,"queueTime":0.000049,"subqueries":0,"totalEntriesReturned":100,"splits":1,"shards":0},"querier":{"store":{"totalChunksRef":0,"totalChunksDownloaded":0,"chunksDownloadTime":0,"chunk":{"headChunkBytes":0,"headChunkLines":0,"decompressedBytes":0,"decompressedLines":0,"compressedBytes":0,"totalDuplicates":0}}},"ingester":{"totalReached":1,"totalChunksMatched":22,"totalBatches":1,"totalLinesSent":100,"store":{"totalChunksRef":19,"totalChunksDownloaded":19,"chunksDownloadTime":588168,"chunk":{"headChunkBytes":1656270,"headChunkLines":861,"decompressedBytes":3159290,"decompressedLines":1477,"compressedBytes":1741438,"totalDuplicates":0}}},"cache":{"chunk":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0},"index":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0},"result":{"entriesFound":0,"entriesRequested":0,"entriesStored":0,"bytesReceived":0,"bytesSent":0,"requests":0,"downloadTime":0}}}}
```