Container of the Week – factorish/syslog

Welcome to another episode of Container of the Week! This time we are going to look at a utility container that assists you in debugging container operation or just helping to understand what’s going on.

Sometimes testing out a new container or troubleshooting is a simple matter of using “docker logs“. Unfortunately some containers do not log very much to standard output but instead use syslog. The factorish/syslog container can be used to start a simple syslog container in a few seconds to aid troubleshooting a container setup.

A syslog server is relatively simple to set up, but as with all things Docker these days, there’s a very easy way to set one up. Paul Czarkowski has made a nifty little container that creates a syslog server using socat, a classic Swiss army knife tool of the Internet.

To create a syslog server running the TCP protocol, run an instance of the factorish/syslog container like so:

$ docker run -p 5140:514 factorish/syslog -t tcp

We choose the local port 5140 in case the Docker host is already running a syslog server on the well-known syslog port. By choosing a non-privileged port the container can also be started as a non-root user. Feel free to choose your own port configuration here.

Test things out by creating a temporary container running Debian Jessie and configuring the syslog client to forward entries to our new syslog server container:

$ docker run --rm -it debian:jessie
root@2155539bcc14:/# logger --tcp --port 5140 --server hello

Inside the factorish/syslog container started previously you should see the following output:

<5>May  7 06:32:18 tpot: hello


What’s interesting now is that all syslog entries produced by the Debian Jessie container are now available to the Docker logging system. This is a bigger deal than it first seems, and can form the basis of a centralized logging setup for a group of containers.