For many years, the syslog-ng project provided container images based on Debian. Most of our users run syslog-ng on RHEL & compatibles, and have asked for an RPM-based container. So, nightly containers based on Alma Linux are now also available.
A while ago, I prepared a small test project to run syslog-ng in an Alma Linux container: https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-container-image-based-on-alma-linux However, that was only an experiment which I never updated. Fast forward to today: nightly syslog-ng containers based on the latest syslog-ng git snapshot package builds are now available on the Docker Hub!
Before you begin
Note that the nightly container images are based on git snapshot builds. While we try to ensure that any git snapshot is as good as a regular release, these packages are less tested in the community than regular releases. This also means that feedback for them is very welcome!
Answering some common questions
Why Alma Linux?
Because while RHEL Universal Base Image is available free of charge, you need RHEL to build an image yourself. Alma Linux has no such restrictions while still providing images very similar to RHEL UBI, as required by our users.
Why Alma Linux 9 when Alma Linux 10 is also available?
Because from the point of view of syslog-ng, there is no difference between the two. And from the point of view of the base image, an RHEL 9 image normally runs both on the previous and the next version.
What is included in the image?
Except for Java and SQL, every syslog-ng module is installed.
Testing
The syslog-ng GitHub repository contains extensive documentation, so in this blog, I only include a quick getting started. Make sure that you have a directory called /data/log available, and that it is empty. You can then download and start the nightly rpm-based container image with the following command:
docker run -d -v /data/log/:/var/log:Z -p 514:514/udp -p 601:601 --name syslog-ng-rpm balabit/syslog-ng-rpm:nightly
This will download the image and start it in the background. Logs will be saved in the /data/log directory of the host. The container receives logs using RFC3164 on UDP port 514 and using RFC5424 on TCP port 601. You can send some test logs with the following commands:
logger --rfc5424 -T -P 601 -n 127.0.0.1 --octet-count this is an TCP test logger --rfc3164 -d -P 514 -n 127.0.0.1 this is an UDP test
You should see these in the /data/log/messages file on the host appearing as:
May 22 13:53:42 host root: this is an TCP test May 22 13:56:25 localhost root: this is an UDP test
You can find a lot more tricks and tips in the documentation at https://github.com/syslog-ng/syslog-ng/blob/develop/docker/dockerhub-overview-rpm.md
What is next?
For now, we provide nightly container builds based on syslog-ng git snapshot builds. However, once the next stable syslog-ng release is available, versioned containers will be available as well. Until then, please share your problems, recommendations and positive experiences with us!
-
If you have questions or comments related to syslog-ng, do not hesitate to contact us. You can reach us by email or even chat with us. For a list of possibilities, check our GitHub page under the “Community” section at https://github.com/syslog-ng/syslog-ng. On Twitter, I am available as @PCzanik, on Mastodon as @Pczanik@fosstodon.org.