Not long ago, I was finalizing the deployment of the MVP of an internal tool. Our standard containerized environment use Syslog to dispatch logs.
The aforementioned tool is written in Django that fortunately has rfc5424-logging-handler library for handling log communication to SysLog. But I still needed to test that my configuration works before any actual deployment.
That is where Docker came to the rescue.

Django configuration

Below the Django configuration I used

LOGGING["handlers"]["syslog"] = {
    "level": LOG_LEVEL,
    "formatter": "mesos",
    "class": "rfc5424logging.handler.Rfc5424SysLogHandler",
    "appname": app_name,
    "facility": LOG_LOCAL5,
}
LOGGING["root"]["handlers"].append("syslog")

It is rather trivial I declare the Syslog handler I want to use and the facility that will be used. Note that it uses the UDP protocol by default.

The docker image

I did not want to install Syslog or change the configuration locally. I try to isolate as much as I can the changes because it is easier to switch environments between projects and spot problems when you introduce changes.

This is why I created the following Docker image to test my setup

FROM python:3.6-buster

RUN apt-get update \
&& apt-get install -y --no-install-recommends \
rsyslog vim less \
&& rm -rf /var/lib/apt/lists/*

RUN echo '\nlocal5.*              /var/log/internal_tool.log' >> /etc/rsyslog.conf

WORKDIR /usr/src/app
COPY requirements ./requirements
RUN pip install -r requirements/base.txt -r requirements/local.txt
COPY . .

EXPOSE 8000
CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]

It installs syslog, redirects local5 facility to a local file, install our app and runs it.

So then we can build, docker image build..., and run the container, docker container run.... As rsyslog is not listening UDP:514 by default, like the default log handler configuration above expects, the following lines have to be uncommented in /etc/rsyslog.conf.

#module(load="imudp")
#input(type="imudp" port="514")

Note that we could also have prepared a configuration file and load it directly in the image. Then restart the rsylog daemon /usr/sbin/rsyslogd -n -iNONE&

Finally

You can test that your configuration is OK with logger -p local5.error "Troubleshooting test". What is expected is the creation or update of the /var/log/internal_tool.log file containing the phrase "Troubleshooting test".

Last modified on 2023-10-28