The rocket-fast system for log processing

docker specifics

This page talks about docker, as this is the platform the rsyslog team has hands-on experience with. Some or all of the information might also apply to other solutions.

Potential Trouble causes:

  • container terminate timeout

    By default, a docker container has 10 seconds to shut down. If rsyslog is running with a large queue that needs to be persisted to disk, that amount of time might be insufficient. This can lead to a hard kill of rsyslog and potentially cause queue corruption.

  • shared work directories

    Shared work directories call for problems and shall be avoided. If multiple instances use the same work directory, the may even overwrite some files, resulting in a total mess. Each container instance should have its own work directory.

See also

If you would like to contribute to these docs, but are unsure where to start, please see the rsyslog-doc project README for an overview of the process. If you would like to contribute to the main source project, please review the contribution guidelines listed in the rsyslog project README.

If you have a question about these docs or Rsyslog in general, please see the following resources:

© 2008-2017, Rainer Gerhards and Others. This site uses the “better” theme for Sphinx.