anchor.diff:  size].
   
   xref:../install_config/aggregate_logging.adoc#install-config-aggregate-logging[Learn more about installing EFK].
  +
  +
  +[[install-config-aggregate-logging-sizing-guidelines-large-cluster-installation]]
  +=== Large Clusters
  +
  +At 100 nodes or more, it is recommended to pre-pull the logging images first and to set `ImagePullPolicy: IfNotPresent` in the *_logging-deployer.yaml_* file. After deploying the logging infrastructure pods (Elasticsearch, Kibana and Curator), node labeling should be done in steps of 20 nodes at a time. For example:
  +
  +Using a simple loop:
  +
  +----
  +$ while read node; do oc label nodes $node logging-infra-fluentd=true; done < 20_fluentd.lst
  +----
  +
  +The below also works:
  +
  +----
  +$ oc label nodes 10.10.0.{100..119} logging-infra-fluentd=true
  +----
  +
  +Labeling nodes in groups paces the DaemonSets used by OpenShift logging, helping to avoid contention on shared resources such as the image registry.
  +
  +
  +[NOTE]
  +====
  +Check for the occurence of any "CrashLoopBackOff | ImagePullFailed | Error" issues.
  +`oc logs <pod>`, `oc describe pod <pod>` and `oc get event` are helpful diagnostic commands.
  +====
  +
   
   [[install-config-aggregate-logging-sizing-guidelines-rate-limiting]]
   == Systemd-journald and rsyslog
  
positive.code: $ oc project logging
  ----
  
  If you are installing in a PoC or testing environment, a local openshift-ansible
  template install is recommended.
  
  ----
  $ oc create -f ${OPENSHIFT_ANSIBLE_REPO}/roles/openshift_examples/files/examples/${VERSION}/infrastructure-templates/origin/logging-deployer.yaml
  ----
  
  Elasticsearch (ES) should be deployed with a cluster size of at least three for
  
negative.code: 
  Installation can take some time depending on whether the images were already
  retrieved from the registry or not, and on the size of your cluster.
  
  Inside the *logging* namespace, you can check your deployment with `oc get all`.
  
  