How logging works - cloudfoundry/cloud_controller_ng GitHub Wiki
Tee'd output
The bash function tee_output_to_sys_log_and_file here takes STDOUT and STDERR for the bash script and outputs to log files in /var/vcap/sys/log/cloud_controller and to syslog. For example, our CC startup script here writes logs to cloud_controller_ng_ctl.log and cloud_controller_ng_ctl.err.log using this tee function.
**Note: If you want to "puts" debugging output, it appears in the cloud_controller_ng_ctl.log because of the above function.
Steno
The StenoLogger used in most places in cloud controller writes directly to the configured file and also to syslog, where syslogs are stored in /var/log. It doesn't go through the tee above since it doesn't write to STDOUT or STDERR.
Logger
The regular ruby Logger just writes to the configured file and does not write to syslog.
Syslog-release
Anything in /var/vcap/sys/log folder gets sent to syslog aggregators via the "blackbox" component along with regular syslog output (stuff in /var/log) through the new syslog-release job (This currently results in duplication).
There is a flag forward_files which when disabled, means that the syslog-release will no longer forward logs from var/vcap/sys/log although they will continue forwarding logs from syslog.