Getting Data In

Where does docker's splunk-logging-plugin read splunk-capath from?

positr0n
New Member

I have docker running with docker-machine on my Mac.

In my docker VM I have loaded my company's internal root certificate in /etc/ssl/cacert.pem.

Install the plugin with docker plugin enable splunk-logging-plugin

In /etc/docker/daemon.json I set splunk-capath to that file.

When I start a docker image I get error creating splunk logger: open /etc/ssl/cacert.pem: no such file or directory"

When I change splunk-capath to a random cert on the image I'm running it appears to load and try to use it for TLS verification.

Does this mean I need to add the corporate certs to every docker image I am going to run for the docker splunk forwarder to work?

0 Karma

positr0n
New Member

Answering my question, the splunk logger runs in it's own docker container. https://github.com/splunk/docker-logging-plugin/blob/develop/Dockerfile

So splunk-capath is in this container. I guess you need to make your own image FROM that one with your certs if you want to add certs to it.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...