jpetazzo / syslogdocker Goto Github PK

View Code? Open in Web Editor NEW

70.0 4.0 19.0 4 KB

syslogdocker's Introduction

One syslog to rule them all

Build the syslog container:

docker build -t syslog .
Monitor the logs:

docker run --volumes-from syslog ubuntu tail -f /var/log/syslog
Run it:

docker run --name syslog -d -v /tmp/syslogdev:/dev syslog
Start another container to send logs:

docker run -v /tmp/syslogdev/log:/dev/log ubuntu logger hello
Alternative to #2, as of docker v1.3 use the docker-exec command to inspect syslog container directly, after some logs have been generated

docker exec -t syslog tail -f /var/log/syslog
See in the log message show up in the "tail" container.

Background

For more information on this approach, see Multiple Docker containers logging to a single syslog.

Other methods

See #4 for insights about achieving similar results without requiring an host bind moount (thanks @helderco!)

syslogdocker's People

Contributors

Stargazers

Watchers

Forkers

miguelramosfdz colinhuang dockerimages unixorn afolarin bossjones eranchetz mbessler ninjasphere sivagnanamciena edraak cjpearson81 caike thiagozs usrcoin-interesting nghinv

syslogdocker's Issues

Syslog container dies

I modified Dockerfile to use "18.04" as a base instead of "14.04" since we use that as a base for all our other containers. When I run it, it exits immediately:

$ docker run --name syslog -v /tmp/syslogdev:/dev syslog --rm
container_linux.go:247: starting container process caused "no such file or directory"
docker: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "no such file or directory".
ERRO[0000] error getting events from daemon: net/http: request canceled

It fails similarly for "14.04" as well.

Solution without host bind mount

Hey, just wanted to share what I did to prevent the need for the host bind mount.

The idea is that I use a different location for the /dev/log socket, so that I can do --volumes-from without conflict. On another container, I just symlink /dev/log to that location. I also send the logs that I want to stderr so that I can do docker logs to get them.

syslog Dockerfile:

FROM debian:jessie

RUN apt-get update && \
    apt-get install rsyslog --no-install-recommends -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

COPY rsyslog.conf /etc/
VOLUME /var/run/rsyslog/dev

CMD ["rsyslogd", "-n"]

/etc/rsyslog.conf:

# load imuxsock module with alternative socket location
module(load="imuxsock")
input(type="imuxsock" Socket="/var/run/rsyslog/dev/log" CreatePath="on")

...

#
# Send your logs to stderr so that `docker logs` works
#
local1.*  {
    /proc/self/fd/2
    stop
}

Now, for example, in a PHP container you do --volumes-from syslog and run ln -sf /var/run/rsyslog/dev/log /dev/log (I do it in an entrypoint, but you get the idea of what needs to happen).

Example:

php:
  build: docker/php
  volumes_from:
    - syslog

syslog:
  image: helder/syslog

Now when my PHP container sends something to LOCAL1 using syslog, I get those with docker-compose logs syslog.

errors running this on boot2docker

rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [try http://www.rsyslog.com/e/2145 ]
rsyslogd: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]

no longer works with docker 1.10

According to this issue:

-v /tmp/syslogdev:/dev

is no longer supported by Docker 1.10 and so the technique you documented here no longer works.

I would be interested to know if you have an alternative technique that works with Docker 1.10.

Possible issues with rsyslog swVersion 7.4.4

I used your Docker with very few modifcations

BUILD-USING: docker build -t quasaur/rsyslogdimage . 2>&1 | tee ./output.txt

RUN-USING: docker run -d -p 9514:514 --name clmrsyslogd quasaur/rsyslogdimage

RUN-USING: docker inspect clmrsyslogd | grep IPAddress

TAIL-LOGS-USING: docker run --volumes-from clmrsyslogd ubuntu tail -f /var/log/syslog

FROM ubuntu:14.04

RUN apt-get update -q
RUN apt-get install rsyslog

VOLUME /dev
VOLUME /var/log

CMD ["rsyslogd", "-n"]

Then i ran your tail command as listed above.

...then i got the following error:
"Aug 30 04:48:56 6e0768d53a28 rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="1" x-info="http://www.rsyslog.com"] start
Aug 30 04:48:56 6e0768d53a28 rsyslogd: imklog: cannot open kernel log(/proc/kmsg): Operation not permitted.
Aug 30 04:48:56 6e0768d53a28 rsyslogd-2145: activation of module imklog failed [try http://www.rsyslog.com/e/2145 ]
Aug 30 04:48:56 6e0768d53a28 rsyslogd: rsyslogd's groupid changed to 104
Aug 30 04:48:56 6e0768d53a28 rsyslogd: rsyslogd's userid changed to 101
Aug 30 04:48:56 6e0768d53a28 rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]"

...any assistance you can offer would be greatly appreciated!