Docker container sshd logs

Question

How to enable ssh connections log (/var/log/auth.log) in a Docker container with openssh-server?

The /var/log/auth.log not exists in my container.

• Docker version: 9.0
• Host: Ubuntu 13.10
• Container: Ubuntu 13.10

Answer 1

The auth log is managed by the Syslog service. This service itself is traditionally managed (started) by the init system (Upstart in your case). By default a container doesn't run an init system, meaning that you'd have to start rsyslog manually :

# rsyslogd

After that, you'll find your usual log files in /var/log.

NB: init systems are not fully compatible with Docker containers. A common practice is to use Supervisord to start multiple services/processes automatically.

Answer 2

rsyslog在 docker 容器中安装包：

$ apt-get install rsyslog

然后启动守护进程：

$ service rsyslog start

似乎可以忽略如下消息，无论如何都要sshd登录/var/log/auth.log。

 * Starting enhanced syslogd rsyslogd                                                                                                                                                                                                           
rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [v8.32.0 try http://www.rsyslog.com/e/2145 ]