PCF - Log Drain

what is a log drain?

Logs are treated as event stream in CF. CF executor with the help of Metron agent send the logs to Loggregator. Doppler is the responsible for forwarding the logs to different log drains i.e. system logs i.e. splunk, paper trail etc... Traffic controller publish the logs to developer terminal and websocket endpoint i.e. Firehose. Nozzles extract the logs form Firehose.

How do you create one?
By creating user provided service and assigning the log drain path.

$ cf create-user-provided-service SERVICE-INSTANCE -l SYSLOG-URL

$ cf bind-service YOUR-APP-NAME SERVICE-INSTANCE

Why would you use it?
To search, filter the logs, debug applications, create reports, find out top exceptions. 

What is “Syslog”?
System log