katalytic/liblogtap-demo repository overview

⁠liblogtap-demo

This image is to run a demo with liblogtap, a Linux library which may be used to tap into logs of containers and to analyze, transform or redirect the output. Find the github repository at https://github.com/katalyticIT/liblogtap⁠ .

⁠What liblogtap does

The liblogtap library gets (pre)loaded using the environment variable LD_PRELOAD to be inserted between the app and the Linux kernel. There it overwrites the central functions write() and writev(), tapping into the stdout and stderr streams and writing copies of the data into a file or a socket. If the latter resides on a shared volume, another process may read from file or socket and process the data according to your needs.

⁠Use cases

Modern apps should follow the 12 factors pattern, once they're packaged into a docker image, but there's still some around which don't, writing their logs into the containers filesystem (or an attached volume). To fix this, liblogtap is able to intercept the data of a given logfile and instead write it into a socket, where the sidecar can pick it up, forwarding it into the place you want. Additionally, an environment variable may be set to suppress the writing to the original logfile, reducing disk i/o and keeping the containers filesystem clean.

Another use case for this library may be the situation where your company is gathering all logs centrally using a common produkt like the ELK stack or something similar, but where that doesn't fit your needs, or access or changes needed are way to bureaucratic. You may even build your custom log gathering client based on this demo to route the logs to a central sink like elastic, flume or hbase, using a sidecar running a customized image with fluentd or similar.

This library puts you back in control, allowing you to decide for yourself how and where you want to use the logs, regardless of whether it's a self-written application or a container with third-party software.