rsyslog

README.md

quick and dirty rsyslog target in a docker container

docker-compose.yml

version: '3'
services:
  logserver:
    build: .
    ports:
      - "5000:514/udp"
      - "5000:514/tcp"
    volumes:
      - logs:/var/syslog/hosts
volumes:
  logs:

Dockerfile

FROM ubuntu
RUN echo "deb http://us.archive.ubuntu.com/ubuntu/ precise main universe" >> /etc/apt/source.list
RUN apt-get update
RUN apt-get -y install rsyslog
ADD ./rsyslog.conf /etc/rsyslog.conf
ENTRYPOINT ["/usr/sbin/rsyslogd", "-n"]

rsyslog.conf

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

# log every host in its own directory
$template RemoteHost,"/var/syslog/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/syslog.log"

*.* ?RemoteHost

run.sh

#!/bin/bash
docker-compose build
docker-compose up --force-recreate