I have a pretty old LXC configuration, with
kernel 2.6.32 and
LXC 0.7. The problem is I wasn't able to make all syslog-ng instances in both host and containers work. The syslog-ng daemon is running, however isn't writing anything to log files.
The culprit is the
/dev/log UNIX socket.
The syslog in UNIX system is running in client/server mode:
- client is the
syslog()interface in glibc.
syslog()connects to socket
/dev/logand send messages via the socket.
- and server is the listener of socket
/dev/log, such as syslog-ng, rsyslog.
This is how syslog-ng use
- check if
/dev/logis already there, if so unlink it;
And this is how I mount
/dev in container config:
/dev is bind-mounted,
/dev/log is shared among all containers, each time when syslog-ng instance starts, the old
/dev/log is unlinked. The removal apparently will break the current syslog-ng instance listening on it. So at last only one syslog-ng instance (the last one) can work without problem.
Finally I made it work.
First I changed syslog-ng configuration files for both host and containers:
1 2 3 4 5 6 7 8
It means syslog-ng will listen to an alternative socket at
/var/run/syslog-ng.sock instead of
/var is a container private directoy, each syslog-ng can listen without interfering with each other.
At the client end, glibc is still using
/dev/log to write log message, so I made
/dev/log a symbol link:
Now when application calls
syslog(), it connects and send messages to
/var/run/syslog-ng.sock. Syslog-ng who is listening on the socket will handle the message correctly.
To make the change permanent, I changed the start routine in
1 2 3 4 5 6 7 8 9 10 11 12
It makes sure
/dev/log is a correct symbol link when syslog-ng starts.