Getting Data In

Getting containerized universal forwarder to forward host log files

patrickkutch
New Member

I would like to be able to run the forwarder in a container, and have it forward my host logs from /var/log. So I mount the host /var/ into the container under /var/hostvar and run the container (in privileged mode) as such:

docker run -ti --rm --privileged -v /var:/var/hostvar --network host --env "SPLUNK_START_ARGS=--accept-license" --env "SPLUNK_FORWARD_SERVER=10.166.11.158:9997" --env "SPLUNK_PASSWORD=P@ssw0rd" --env "SPLUNK_ADD=/var/hostvar/log/" --name uf splunk/universalforwarder:latest

The directory is mapped correctly, however I get no data out of the forwarder (I can ping the splunk target from wthin the container) The problem seems to be that despite being marked as privileged, it cannot read my host kern.log file. I did a docker exec into the container to cat the file and I get:

#docker exec -ti uf cat /var/hostvar/log/kern.log
cat: /var/hostvar/log/kern.log: Permission denied

I tried to do the same thing (mount that directory, and cat the file) using busybox and it worked just fine.

Anybody have any thoughts?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...