Getting Data In
Highlighted

Getting containerized universal forwarder to forward host log files

New Member

I would like to be able to run the forwarder in a container, and have it forward my host logs from /var/log. So I mount the host /var/ into the container under /var/hostvar and run the container (in privileged mode) as such:

docker run -ti --rm --privileged -v /var:/var/hostvar --network host --env "SPLUNKSTARTARGS=--accept-license" --env "SPLUNKFORWARDSERVER=10.166.11.158:9997" --env "SPLUNKPASSWORD=P@ssw0rd" --env "SPLUNKADD=/var/hostvar/log/" --name uf splunk/universalforwarder:latest

The directory is mapped correctly, however I get no data out of the forwarder (I can ping the splunk target from wthin the container) The problem seems to be that despite being marked as privileged, it cannot read my host kern.log file. I did a docker exec into the container to cat the file and I get:

#docker exec -ti uf cat /var/hostvar/log/kern.log
cat: /var/hostvar/log/kern.log: Permission denied

I tried to do the same thing (mount that directory, and cat the file) using busybox and it worked just fine.

Anybody have any thoughts?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.