Docker Debian Jessie – Can’t Find /var/log/syslog

crondebiandockerlogs

I'm building on top of a Postgres Docker container which has cron implemented on top of Debian Jessie:

For debugging I want to look at the logs which I'm expecting to be at /var/log/syslog, but I don't have syslog on the system.

Would I need to turn on logging manually with a Debian Jessie Docker container?

Best Answer

You need to install rsyslog inside the container. You could do this in dockerfile.

Example of simplest dockerfile:

FROM debian:latest

RUN apt-get install -q -y rsyslog
CMD ["sh", "-c", "service rsyslog start ; tail -f /dev/null"]

Related Solutions

Shell – My /var/log/ is thesteriously filling up GBs in minutes! Any cure before I re-install Debian 7

There is actually a strong hint in the syslog snippet you posted. The end of the line

Apr 10 00:53:37 MyMachine kernel: [11608.690733]  [<ffffffffa08e4005>] ? ath9k_reg_rmw+0x35/0x70 [ath9k_htc]

shows the stack trace is due to an unexpected error in a device driver named ath9k_htc. Hopefully, the kernel didn't panicked but the continuous repetition of errors is filling your file system.

I would then blacklist the ath9k_htc wifi driver using this command then rebooting:

echo "blacklist ath9k_htc" | sudo tee -a /etc/modprobe.d/blacklist.conf

Beware though that doing so might prevent your wifi to work if the ath9k_htc driver was nevertheless used and functional despite the errors.

You can check if a wifi device expected by the ath9k_htc driver is present in your machine by running lsusb and see if a device match one of the list available here: https://wiki.debian.org/ath9k_htc

How should I send systemd logs to a dedicated logging server

It appears that systemd does not have a built-in means of forwarding messages to a syslog server. Red Hat's official recommendation is to use the imjournal module to allow rsyslog to read the journald logs and forward these logs to a central logging server by setting the following in /etc/rsyslog.conf:

module(load="imjournal"
    PersistStateInterval="number_of_messages"
    StateFile="path"
    ratelimit.interval="seconds"
    ratelimit.burst="burst_number"
    IgnorePreviousMessages="off/on")

They provide usage details for these options , noting

With number_of_messages, you can specify how often the journal data must be saved. This will happen each time the specified number of messages is reached.

Replace path with a path to the state file. This file tracks the journal entry that was the last one processed.

With seconds, you set the length of the rate limit interval. The number of messages processed during this interval can not exceed the value specified in burst_number. The default setting is 20,000 messages per 600 seconds. Rsyslog discards messages that come after the maximum burst within the time frame specified.

With IgnorePreviousMessages you can ignore messages that are currently in Journal and import only new messages, which is used when there is no state file specified. The default setting is off. Please note that if this setting is off and there is no state file, all messages in the Journal are processed, even if they were already processed in a previous rsyslog session.

Best Answer

Related Solutions

Shell – My /var/log/ is thesteriously filling up GBs in minutes! Any cure before I re-install Debian 7

How should I send systemd logs to a dedicated logging server

Related Question