Wed 31 August 2022

Filed under Misc

Tags docker

Docker Syslog logging driver

This article discuss the steps to enable syslog logging driver in docker.

Docker comes with a syslog logging driver, which routes logs to a syslog server. Syslog has the advantage of being already available on most of docker hosts, like the case of an Ubuntu host.

We will first setup rsyslog, and then tell docker to use it.

rsyslog set-up

We will collect logs for the docker daemon and for the containers.

We will create a rsyslog conf file /etc/rsyslog.d/10-docker.conf with the following content

$FileCreateMode 0644
$template DockerDaemonLogFileName,"/var/log/docker/docker.log"
$template DockerContainerLogFileName,"/var/log/docker/%SYSLOGTAG:R,ERE,1,FIELD:docker/(.*)\[--end:secpath-replace%.log"
if $programname == 'dockerd' then {
?DockerDaemonLogFileName
stop
}
if $programname == 'containerd' then {
?DockerDaemonLogFileName
stop
}
if $programname == 'docker' then {
if $syslogtag contains 'docker/' then {
?DockerContainerLogFileName
stop
}
}
$FileCreateMode 0600

Once rsyslog configuration is defined we will create the directory to store logs

sudo mkdir /var/log/docker
sudo chown syslog:adm /var/log/docker/

verify that configuration is correct

rsyslogd -f /etc/rsyslog.conf -N1
rsyslogd -f /etc/rsyslog.d/10-docker.conf -N1

In my test system I get this

rsyslogd: version 8.2112.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: End of config validation run. Bye.

restart rsyslog

sudo systemctl restart rsyslog

logrotate set-up

We will set-up logrotate to take care of our docker logs, you will need to do sudo nano /etc/logrotate.d/docker then enter this

/var/log/docker/*.log {
  copytruncate
  compress
  delaycompress
  dateext
  size 20M
  weekly
  dateformat -%Y%m%d
  missingok
  rotate 4
}

now we will restart the logrotate daemon

sudo systemctl restart logrotate

Docker set-up

Once we have rsyslog setup, we can now tell Docker to use it.

In order to enable syslog logging driver you need to edit /etc/docker/daemon.json file

{
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "unixgram:///dev/log",
    "tag": "docker/{{.Name}}",
    "syslog-facility": "daemon"
    }
}

Once you save the configuration file you need to reload the docker daemon

sudo systemctl reload docker

Check logs

You should now be able to see docker log files in /var/log/docker/

have fun!

References

Some useful references

  • https://docs.docker.com/config/containers/logging/syslog/

  • https://www.loggly.com/use-cases/docker-syslog-logging-and-troubleshooting/

  • https://www.commandprompt.com/blog/docker-logging-with-rsyslog/

Comment

Fri 06 May 2022

Filed under Misc

Tags multipass virsh

Manage Ubuntu VMs with multipass.

Read More

Thu 19 March 2020

Filed under Misc

Tags docker

This post cover bits and pieces of docker. I plan to update it as I go.

Read More

Sun 17 February 2019

Filed under Enterprise Architecture

Tags TOGAF Enterprise Architecture

This post explains TOGAF ADM Preliminary Phase. It covers Preliminary phase objectives, inputs, steps, outputs and approach.

Read More

Sat 21 March 2020

Filed under Misc

Tags virsh

This post will go through the steps to manage a VM running on a remote host with virsh.

Read More

Sun 15 March 2020

Filed under Misc

Tags Guacamole VNC SSL RDP docker

This post explain how to install and configure Guacamole using Docker

Read More

Sun 03 February 2019

Filed under Enterprise Architecture

Tags TOGAF Enterprise Architecture

This post is an introduction TOGAF and it's core concepts. It summarizes the content and structure of TOGAF 9 standard.

Read More

Fri 08 February 2019

Filed under Misc

Tags git

This post describes a basic git workflow. This is what I follow to keep track of changes in this blog.

Read More

Sat 09 February 2019

Filed under Enterprise Architecture

Tags TOGAF Enterprise Architecture

This post is an introduction to TOGAF Architecture Development Method (ADM).

Read More

Sat 02 February 2019

Filed under Enterprise Architecture

Tags TOGAF Enterprise Architecture

This post is an introduction to Enterprise Architecture. More specifically it covers what's Enterprise Architecture according to TOGAF.

Read More

Gonzalo Saenz © Gonzalo Saenz Powered by Pelican and Twitter Bootstrap. Icons by Font Awesome and Font Awesome More