I would like to be able to run the forwarder in a container, and have it forward my host logs from /var/log. So I mount the host /var/ into the container under /var/hostvar and run the container (in privileged mode) as such:
docker run -ti --rm --privileged -v /var:/var/hostvar --network host --env "SPLUNK_START_ARGS=--accept-license" --env "SPLUNK_FORWARD_SERVER=10.166.11.158:9997" --env "SPLUNK_PASSWORD=P@ssw0rd" --env "SPLUNK_ADD=/var/hostvar/log/" --name uf splunk/universalforwarder:latest
The directory is mapped correctly, however I get no data out of the forwarder (I can ping the splunk target from wthin the container) The problem seems to be that despite being marked as privileged, it cannot read my host kern.log file. I did a docker exec into the container to cat the file and I get:
#docker exec -ti uf cat /var/hostvar/log/kern.log
cat: /var/hostvar/log/kern.log: Permission denied
I tried to do the same thing (mount that directory, and cat the file) using busybox and it worked just fine.
Anybody have any thoughts?
