Skip to content

Fastest and smaller Rsyslog built with CPU optimization and third party modules

License

Notifications You must be signed in to change notification settings

levonet/docker-rsyslog

Repository files navigation

Supported tags and respective Dockerfile links

Rsyslog

build Docker Pulls

Fastest and smaller Rsyslog built for x86-64 CPU architecture.

This source is used to build an image for rsyslog.

Modules

Rsyslog has a modular design. This enables functionality to be dynamically loaded from modules, which may also be written by any third party. The image contains:

OutputInputParserMessage ModificationFunctionsLibrary
omclickhouse
omelasticsearch
omfile-hardened
omgssapi
omhiredis
omhttp
omhttpfs
omkafka
omlibdbi
ommail
ommongodb
ommysql
ompgsql
omprog
omrelp
omruleset
omstdout
omtesting
omuxsock
im3195
imbatchreport
imdiag
imdocker
imfile
imgssapi
imhiredis
imhttp
imkafka
imklog
immark
impcap
impstats
imptcp
imrelp
imtcp
imtuxedoulog
imudp
imuxsock
pmaixforwardedfrom
pmciscoios
pmcisconames
pmdb2diag
pmlastmsg
pmnormalize
pmnull
pmpanngfw
pmsnare
mmanon
mmaudit
mmcount
mmdarwin
mmdblookup
mmexternal
mmfields
mmgrok
mmjsonparse
mmkubernetes
mmnormalize
mmpstrucdata
mmrfc5424addhmac
mmrm1stspace
mmsequence
mmtaghostname
mmutf8fix
fmhash
fmhttp
lmcry_gcry
lmnet
lmnetstrms
lmnsd_gtls
lmnsd_ossl
lmnsd_ptcp
lmregexp
lmtcpclt
lmtcpsrv
lmzlibw

How to use this image

This container will listen on 514/udp, and 514/tcp and drop all input data without additional configuration.

Rsyslog configuration will load any additionnal configuration files within /etc/rsyslog.d/ ending by the .conf extension.

Run a container from the CLI:

docker run --name rsyslog -d -p 514:514/tcp -p 514:514/udp \
    -v /etc/rsyslog.d:/etc/rsyslog.d \
    -v /path/syslog:/var/log/syslog \
    levonet/rsyslog

Image Variants

levonet/rsyslog:<version>-alpine

This image is based on the popular Alpine Linux project, available in the alpine official image. Alpine Linux is much smaller than most distribution base images (~5MB), and thus leads to much slimmer images in general.

This variant is highly recommended when final image size being as small as possible is desired. The main caveat to note is that it does use musl libc instead of glibc and friends, so certain software might run into issues depending on the depth of their libc requirements. However, most software doesn't have an issue with this, so this variant is usually a very safe choice. See this Hacker News comment thread for more discussion of the issues that might arise and some pro/con comparisons of using Alpine-based images.

To minimize image size, it's uncommon for additional related tools (such as git or bash) to be included in Alpine-based images. Using this image as a base, add the things you need in your own Dockerfile (see the alpine image description for examples of how to install packages if you are unfamiliar).