UPDATE: i created a small repo as an example: https://github.com/rbartl/syslog_container_demo (last commit is with debian:9)
Often i am a bit annoyed by the fact that docker is expecting all Log outputs to come through stderr or stdout.
One Problem i see with this is that i probably want to have more than those 2 channels in some cases, but than can be worked around with the log format.
but the second Problem remains being that some tools want to have a /dev/log or a local syslog UDP port they can talk to.
After playing around with rsyslog – which would not let me output something to stdout apart from its own error messages and thinking about switching to syslog-ng, i searched through apt in debian which packages support syslog.
And i found busybox-syslogd. Small and compact -> should work for a Docker container.
In this example i am using a runit based image and a running postfix smtp server (for which i want to see logs, and into which we will not delve into).
see the interesting parts in the Dockerfile
RUN apt-get update -q -q && \
apt-get --yes --force-yes --no-install-recommends install busybox-syslogd
COPY ./etc /etc
runit service file
and the etc/services/syslog/run file which starts the little syslog daemon
# example: link the log socket into the postfix chroot environment
# example: ln -sf /dev/log /var/spool/postfix/dev/
exec /sbin/syslogd -n -O /dev/stdout
et voilà – everything in that container can use the dev/log socket and output log lines and they will be forwarded do the docker logs collection.
if you run it it would look like this ->
$ docker run -it test123
Sep 25 12:14:18 9c1223d61db7 syslog.info syslogd started: BusyBox v1.22.1
Sep 25 12:14:28 9c1223d61db7 user.notice root: sdf
Ways i tried and failed
Disclaimer: this methods might actually work and i just was to incompetent to configure them correctly…
- mounting /dev/log into another container with a docker-compose.yml file
- getting rsyslog to write into stdout (version 7)
- getting something like haproxy to output to stdout
Ways that would probably be better
- creating a small syslog container and just using its UDP Port