Remote syslog server

Skip to first unread message

Marc Boisis

Nov 24, 2022, 2:59:34 AM11/24/22
to Flatcar Container Linux User
I would like to export all flatcar logs to a remote syslog server (UDP 514).
How can I do this in flatcar ?

Kai Lüke

Nov 24, 2022, 5:48:40 AM11/24/22
to Marc Boisis, Flatcar Container Linux User

I'm not sure about UDP but systemd-journald has ways to forward logs, too.
On one machine you start systemd-journal-gatewayd.socket and then the
collecting machine should be able to get it with "sudo systemd-run
--unit systemd-journal-remote-client
/usr/lib/systemd/systemd-journal-remote --url http://IPADDR:19531".
Reading entries can be done by filtering for the hostname "sudo
journalctl _HOSTNAME=gateway -t core --file
Now that is just the one-time action I copied from our test suite and
not a persistent setup nor in any way secured.
I'm sure that there are other ways, also for UDP - I didn't read the docs.
It's also possible to start extra software in a priv. container, too.
Jeremi or Vincent can maybe share more about a remote logging setup.

> --
> You received this message because you are subscribed to the Google Groups "Flatcar Container Linux User" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> To view this discussion on the web visit

Kinvolk GmbH | Adalbertstr.6a, 10999 Berlin | tel: +491755589364

Geschäftsführer/Directors: Benjamin Owen Orndorff

Registergericht/Court of registration: Amtsgericht Charlottenburg

Registernummer/Registration number: HRB 171414 B

Ust-ID-Nummer/VAT ID number: DE302207000

Marc Boisis

Nov 24, 2022, 6:21:49 AM11/24/22
to Flatcar Container Linux User
The weak point of systemd-journal-remote is the pull method from the centralized log-server.
To avoid missing logs, the push method from client to log-server is better, like "OLD" syslog protocol.

One idea could be a rsyslog docker running on flatcar, collecting journald messages and exporting them in UDP to the centralized  log-server.
What do you think about it ?

Jeremi Piotrowski

Nov 24, 2022, 8:43:59 AM11/24/22
to Flatcar Container Linux User
We have a remote logging setup running with rsyslog in a docker container, i can't provide you with an easy to replicate example but you need to:
- have something like this in your rsyslog.conf:


- run the rsyslog container with `--privileged -v /run/systemd/journal:/run/systemd/journal`
- set `ForwardToSyslog=yes` in your /etc/systemd/journald.conf

With that, the rsyslog container should get all log messages from the machine and can process them or forward them elsewhere.

Reply all
Reply to author
0 new messages