Public | Automated Build

Last pushed: 2 years ago
Short Description
Short description is empty for this repo.
Full Description

One syslog to rule them all

  1. Build the syslog container:

    docker build -t syslog .

  2. Monitor the logs:

    docker run --volumes-from syslog ubuntu tail -f /var/log/syslog

  3. Run it:

    docker run --name syslog -d -v /tmp/syslogdev:/dev syslog

    allow syslogging from localhost over UDP (eg: port 1514):

    docker run --name syslog -d -v /tmp/syslogdev:/dev -p 127.0.0.1:1514:514/udp syslog

  4. Start another container to send logs:

    docker run -v /tmp/syslogdev/log:/dev/log ubuntu logger hello

  1. Alternative to #2, as of docker v1.3 use the docker-exec command to inspect syslog container directly, after some logs have been generated

    docker exec -t syslog tail -f /var/log/syslog

  2. See in the log message show up in the "tail" container.

  1. Logging to SemaText's Logsene service:

    To log to remote Logsene service, run with these environment variables:

    • LOGSENE_SYSLOG_HOST - remote hostname, usually: logsene-receiver-syslog.sematext.com
    • LOGSENE_APP_TOKEN - your Logsene application token

    docker run --name syslog -d -v /tmp/syslogdev:/dev -e LOGSENE_SYSLOG_HOST=logsene-receiver-syslog.sematext.com -e LOGSENE_APP_TOKEN=<your token> -p 127.0.0.1:1514:514/udp syslog

  2. Logging to any remote Syslog (over UDP):

    To log to a remote syslog deamon (currently UDP), run with these environment variables:

    • REMOTE_SYSLOG_HOST - remote hostname, eg. syslog.example.com
    • REMOTE_SYSLOG_PORT - syslog port, defaults to 514
    • REMOTE_SYSLOG_PROTO - protocol, udp or tcp, to talk to remote syslog server; defaults to 'udp'

    docker run --name syslog -d -v /tmp/syslogdev:/dev -e REMOTE_SYSLOG_HOST=syslog.example.com -e REMOTE_SYSLOG_PORT=5140 -e REMOTE_SYSLOG_PORT=udp -p 127.0.0.1:1514:514/udp syslog

  3. With systemd-journald forwarding host journal to container:

    • READ_FROM_JOURNALD - set to 1 if you want rsyslog to read from mapped socket (assumes the socket was created by "something" eg. a syslog.socket systemd unit)
      Ensure that journald is configured for syslog forwarding, set the following in /etc/systemd/journal.conf.d/99-forward-to-sylog.conf
      [Journal]
      ForwardToSyslog=yes
      MaxLevelSyslog=debug
      

    docker run --name syslog -d -v /tmp/syslogdev:/dev -e READ_FROM_JOURNALD=1 -v /run/systemd/journal/syslog:/run/systemd/journal/syslog -e REMOTE_SYSLOG_HOST=syslog.example.com -e REMOTE_SYSLOG_PORT=5140 -e REMOTE_SYSLOG_PORT=udp -p 127.0.0.1:1514:514/udp syslog

Note: this container is also available on Docker Hub: https://hub.docker.com/r/mbessler/syslogdocker/

Background

For more information on this approach, see Multiple Docker containers logging to a single syslog.

Written with StackEdit.

Docker Pull Command
Owner
mbessler
Source Repository

Comments (0)