Willing to know more about syslog-ng docker container? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team assist with this query.

Syslog-ng docker container

Basically, syslog-ng allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.

Today, let us see the steps followed by our Support Techs to configure syslog-ng

1. Firstly, edit the syslog-ng configuration file

Below setup will create messages_local for syslog-ng logs and messages_HOST_PROGRAM for each docker container, automatically, without any additional filter.

It will work on the fly, you do not need to add custom filters for each docker you configure to send it’s messages there.

@version: 3.29
@include "scl.conf"

source s_local {
 internal();
};

source s_network {
 default-network-drivers(
 );
};

destination d_local {
        file("/var/log/messages_local");
};

destination d_network {
 file("/var/log/messages_${HOST}_${PROGRAM}" template("$(format-welf --scope all-nv-pairs)\n") frac-digits(3));
};

log {
        source(s_local);
        destination(d_local);
};

log {
 source(s_network);
 destination(d_network);
};

2. Then, start syslog-ng container.

DOCKER_IP=192.168.11.30
DOCKER_NAME=syslog
DOCKER_IMAGE=balabit/syslog-ng:latest
DATA_DIR=/docker/DATA/services/syslog/logs
CONFIG_FILE=/docker/DATA/services/syslog/syslog-ng.conf

docker run -d \
  --name ${DOCKER_NAME} \
  --restart=always \
  --publish ${DOCKER_IP}514:514/udp \
  --publish ${DOCKER_IP}601:601 \
  --publish ${DOCKER_IP}6514:6514 \
  --volume ${DATA_DIR}:/var/log \
  --volume ${CONFIG_FILE}:/etc/syslog-ng/syslog-ng.conf \
  ${DOCKER_IMAGE}

The running container should look like this:

23:22:55 root@sonic:logs# docker container ls | grep syslog
dd5bcd591fb4        balabit/syslog-ng:latest                         "/usr/sbin/syslog-ng…"   4 hours ago         Up 4 hours (healthy)   192.168.11.30:601->601/tcp, 192.168.11.30:514->514/udp, 192.168.11.30:6514->6514/tcp                                                                                                                                                   syslog

3. Next, start the container for which you want to send the logs to our newly created syslog container as follows:

This container runs bind9 with a custom docker image.

DOCKER_IP=192.168.11.25
DOCKER_IMAGE=bind9
DATA_DIR=/docker/DATA/services/bind9
docker run -d \
  --restart=always \
  --name ${DOCKER_NAME} \
  --log-driver=syslog \
  --log-opt syslog-address=udp://192.168.11.30:514 \
  --log-opt tag=${DOCKER_NAME} \
  --log-opt syslog-format=rfc5424micro \
  --publish ${DOCKER_IP}53:53/udp \
  --publish ${DOCKER_IP}53:53/tcp \
  -v ${DATA_DIR}:/etc/bind \
  ${DOCKER_IMAGE}

4. Finally, go to your syslog folder and see if the logs were created

In this setup, you should have the following logs there:

23:40:50 root@sonic:logs# ls
messages_local  messages_sonic_bind9

[Looking for a solution to another query? We are just a click away.]

Conclusion

To sum up, our skilled Support Engineers at Bobcares demonstrated how to configure in docker container