From 86da33773a145e93aede68e5655cdd3d73b0c25e Mon Sep 17 00:00:00 2001
From: Joerg Lehmann <joerg.lehmann@nbit.ch>
Date: Fri, 24 Jun 2022 11:09:33 +0200
Subject: [PATCH] logging for docker with rsyslogd

---
 README.md | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/README.md b/README.md
index 4691366..4c0b215 100644
--- a/README.md
+++ b/README.md
@@ -204,6 +204,70 @@ WantedBy=multi-user.target
 # systemctl enable --now docker-compose@nbit_websites
 ```
 
+## Logging
+
+```bash
+root@moby:~# cat /etc/docker/daemon.json
+{
+	"log-driver": "syslog",
+	"log-opts": {
+		"syslog-address": "unixgram:///dev/log",
+		"tag": "docker/{{.Name}}"
+	}
+}
+```
+
+```bash
+root@moby:~# grep -C 3 PreserveFQDN /etc/rsyslog.conf
+$IncludeConfig /etc/rsyslog.d/*.conf
+
+# see https://www.commandprompt.com/blog/docker-logging-with-rsyslog/
+$PreserveFQDN on
+```
+
+```bash
+root@moby:~# cat /etc/rsyslog.d/10-docker.conf
+$FileCreateMode 0644
+$template DockerDaemonLogFileName, "/var/log/docker/docker.log"
+$template DockerContainerLogFileName, "/var/log/docker/%SYSLOGTAG:R,ERE,1,FIELD:docker/(.*)\[--end:secpath-replace%.log"
+if $programname == 'dockerd'
+then {
+	?DockerDaemonLogFileName
+	stop
+}
+if $programname == 'containerd'
+then {
+	?DockerDaemonLogFileName
+	stop
+}
+if $programname == 'docker'
+then {
+	if $syslogtag contains 'docker/'
+	then {
+		?DockerContainerLogFileName
+		stop
+	}
+}
+$FileCreateMode 0600
+```
+
+```bash
+root@moby:~# cat /etc/logrotate.d/rsyslog-docker
+/var/log/docker/*.log
+{
+	daily
+	rotate 10
+	minsize 200M
+	missingok
+	notifempty
+	compress
+	sharedscripts
+	postrotate
+		/usr/lib/rsyslog/rsyslog-rotate
+	endscript
+}
+```
+
 
 ## Wordpress behind Traefik