logging through up to host / systemd init container
I wonder whats the current best approach for having the logs of one container accumulated at the host layer (journald). The container runs systemd/journald and is started via a quadlet config with LogDriver=passthrough. So, everything that the container spells out via stderr/stdout is captured at the host layer. How to pass everything of the container journald to the host journald? I played with LogTarget in /etc/systemd/system.conf without success. I'd really appreciate any ideas! -- Leon
Are you doing this for rootless podman or rootfull? I hacked my way through this very thing and eventually got it working for rootless podman. It required some tricks but sadly I deleted the VM long ago and don't remember them. I vaguely remember I had to add the user into a special group on the host. "LogDriver=passthrough" rings bells for me. "LogTarget in /etc/systemd/system.conf" also seems familiar. Sorry I can't remember more. What you're trying is _possible_ though. --- Chris Evich (he/him) Senior Quality Assurance Engineer If there's a "hard-way", I'm the first one to implement it. On 5/8/24 15:38, Leon Fauster via Podman wrote:
I wonder whats the current best approach for having the logs of one container accumulated at the host layer (journald).
The container runs systemd/journald and is started via a quadlet config with LogDriver=passthrough. So, everything that the container spells out via stderr/stdout is captured at the host layer.
How to pass everything of the container journald to the host journald? I played with LogTarget in /etc/systemd/system.conf without success.
I'd really appreciate any ideas!
Am 09.05.24 um 16:07 schrieb Chris Evich:
On 5/8/24 15:38, Leon Fauster via Podman wrote:
I wonder whats the current best approach for having the logs of one container accumulated at the host layer (journald).
The container runs systemd/journald and is started via a quadlet config with LogDriver=passthrough. So, everything that the container spells out via stderr/stdout is captured at the host layer.
How to pass everything of the container journald to the host journald? I played with LogTarget in /etc/systemd/system.conf without success.
I'd really appreciate any ideas!
Are you doing this for rootless podman or rootfull?
I hacked my way through this very thing and eventually got it working for rootless podman. It required some tricks but sadly I deleted the VM long ago and don't remember them. I vaguely remember I had to add the user into a special group on the host.
"LogDriver=passthrough" rings bells for me.
"LogTarget in /etc/systemd/system.conf" also seems familiar.
Sorry I can't remember more. What you're trying is _possible_ though.
The container runs in a rootless podman environment (RHEL9). I played a bit with " -v /dev/log:/dev/log " and it at least logs some messages but the log stream in the container is splitted when doing this way (not all messages are forwarded to the host) and the content of the logs are not namespaced on the host layer. What I have now. Container runs with log_driver=journald or when started via quadlet with log-driver=passthrough. The journald in the container has following drop-in $ cat /etc/systemd/journald.conf.d/forward.conf [Journal] ForwardToConsole=yes The host gets namespaced log entries of the container now. It seems that everything is arriving at the host level. I'm testing this the first time. So, it seems to work but not sure if this way is the best practice way ...? -- Leon
On 5/9/24 15:33, Leon Fauster via Podman wrote:
I'm testing this the first time. So, it seems to work but not sure if this way is the best practice way ...?
Oh good I'm glad you got it working. Sorry I couldn't be of more technical help :( "Best" is often hard to answer, because we don't know your requirements, expectations, budget, etc. Maybe a slightly better question to ask could be (I may get some details wrong for your setup, sorry): What's the /simplest/ way to ensure journal events inside a rootless container are made available in a namespaced way on a RHEL9 host's journal? You may also get a more exposure by posting the question on the upstream discussions board. I think more people read that than the mailing list? https://github.com/containers/podman/discussions A search for "journal" on the list produces a lot of results as well: https://github.com/containers/podman/discussions?discussions_q=journal Hope that helps.
Am 09.05.24 um 22:33 schrieb Chris Evich:
On 5/9/24 15:33, Leon Fauster via Podman wrote:
I'm testing this the first time. So, it seems to work but not sure if this way is the best practice way ...?
Oh good I'm glad you got it working. Sorry I couldn't be of more technical help :(
"Best" is often hard to answer, because we don't know your requirements, expectations, budget, etc. Maybe a slightly better question to ask could be (I may get some details wrong for your setup, sorry):
What's the /simplest/ way to ensure journal events inside a rootless container are made available in a namespaced way on a RHEL9 host's journal?
That depict it nicely :-)
You may also get a more exposure by posting the question on the upstream discussions board. I think more people read that than the mailing list?
https://github.com/containers/podman/discussions
A search for "journal" on the list produces a lot of results as well:
https://github.com/containers/podman/discussions?discussions_q=journal
I was not aware of that place. Thanks for the hint! -- Leon
participants (2)
-
Chris Evich -
Leon Fauster