如何使fail2ban读取json docker日志

Question

是否可以配置我的fail2ban jail.conf来检查docker日志,而不是将日志安装在主机中.例如,将logpath设置为容器日志的路径.

Jail.conf:

...
#example
[nginx-http-auth]
    enabled = true
    filter  = nginx-http-auth
    port    = http,https
    logpath = /var/lib/docker/containers/819564257d4*/*e0923e-json.log
...

但是这没什么用,因为docker logs命令和日志文件之间有一点差别:

# docker logs @nginx_container_name 

2016/03/23 12:39:52 [错误] 6#6:*350上游过早关闭连接,同时从上游读取响应头,客户端: @ATTACKER_IP,服务器:@MY_DNS,请求:"GET/Blog/wp-login .php HTTP/1.1",上游:" http://172.17.0.3:8001/Blog/wp-login.php ",主持人:" @ MYY:80 :" @ ATTACKER_IP - - [23/Mar/2016:12: 39:52 +0000]"GET /Blog/wp-login.php HTTP/1.1"502 173" - ""Python-urllib/2.7"

# cat /var/lib/docker/containers/819564257d4*/*e0923e-json.log

{"log":"2016/03/23 12:39:52 [错误] 6#6:*350上游过早关闭连接,同时从上游读取响应头,客户端:@ATTACKER_IP,服务器:@MY_DNS,请求:\" GET /Blog/wp-login.php HTTP/1.1 \",上游:\" http://172.17.0.3:8001/Blog/wp-login.php \",主持人:\" @MY_IP:80 \"\n","stream":"stdout","time":"2016-03-23T12:39:52.219982304Z"} {"log":" @ ATTACKER_IP - - [23/Mar/2016:12:39:52 +0000] \"GET /Blog/wp-login.php HTTP/1.1 \"502 173 \" - \"\"Python-urllib/2.7 \"\n","stream":"stdout","time" : "2016-03-23T12:39:52.421767592Z"}

我准确地将日志文件挂载到主机中,我知道这是愚蠢的,所以我的问题是:

• 有没有办法让rsyslog读取docker nginx容器的json日志文件
• 如果没有,如何配置docker来制作syslog日志格式
• 如果没有,如何在容器上配置syslog以便将日志传递给我的主机？

谢谢 !

Answer 1

您可以配置容器将日志发送到 syslog，请参阅https://docs.docker.com/engine/admin/logging/overview/