Getting Data In

Where does docker's splunk-logging-plugin read splunk-capath from?

positr0n
New Member

I have docker running with docker-machine on my Mac.

In my docker VM I have loaded my company's internal root certificate in /etc/ssl/cacert.pem.

Install the plugin with docker plugin enable splunk-logging-plugin

In /etc/docker/daemon.json I set splunk-capath to that file.

When I start a docker image I get error creating splunk logger: open /etc/ssl/cacert.pem: no such file or directory"

When I change splunk-capath to a random cert on the image I'm running it appears to load and try to use it for TLS verification.

Does this mean I need to add the corporate certs to every docker image I am going to run for the docker splunk forwarder to work?

0 Karma

positr0n
New Member

Answering my question, the splunk logger runs in it's own docker container. https://github.com/splunk/docker-logging-plugin/blob/develop/Dockerfile

So splunk-capath is in this container. I guess you need to make your own image FROM that one with your certs if you want to add certs to it.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...