将Docker作为syslog-ng目标运行失败

Question

I have a Vagrant-created VM running stock Ubuntu Trusty 64, with one host CPU allocated to it. Within that VM, I have a Docker image running stock Python 3.4.3:

FROM python:3.4.3-slim

ENTRYPOINT ["/usr/local/bin/python"]

When I execute an arbitrary Python script:

import time

while True:
    time.sleep(1)

Like this:

sudo docker run -i -v /etc/alloy_listener/scripts:/scripts:ro alloy_listener /scripts/test.py

Everything is fine, the container run and just sits there doing very little. If I add print statements to the Python script, it gets sent to stdout as expected.

I also have syslog-ng installed in that VM, and my intention is to use my containerized Python to act as syslog-ng destination:

source s_foo {
  unix-stream("/dev/log");
};

destination d_foo {
  program("'docker run -i -v /etc/alloy_listener/scripts:/scripts:ro alloy_listener /scripts/test.py'");
};

log {
  source(s_foo);
  destination(d_foo);
};

But when I reload the config, syslog-ng consumes about 20% of the VM's CPU, and 100% of the host's CPU, and the container never gets created (running sudo docker ps -a yields no containers). Running sudo syslog-ng-ctl stats tells me that it is trying to execute the program:

dst.program;d_foo#0;'docker run -i -v /etc/alloy_listener/scripts:/scripts:ro alloy_listener /scripts/test.py';a;dropped;0
dst.program;d_foo#0;'docker run -i -v /etc/alloy_listener/scripts:/scripts:ro alloy_listener /scripts/test.py';a;processed;2
dst.program;d_foo#0;'docker run -i -v /etc/alloy_listener/scripts:/scripts:ro alloy_listener /scripts/test.py';a;stored;0

My feeling is that because syslog-ng is using 20% of its CPU, but 100% of the host's, it's I/O bound and the VM is working extra-hard to keep up. To that end I tried consuming and flushing stdin and stdout in the Python script, but as far as I can tell because it's not even creating the container, it isn't getting as far as the script.

So my next thought was there must be some combination of docker's -a , -d , -i , and -t flags that I've not tried, but I'm sure I have tried every permissible combination to no avail.

What have I missed?

Answer 1

If you start syslog-ng in foreground (syslog-ng-binary -Fedv) you see that syslog-ng starts and stops the program destination in a loop, this cause the 100% CPU spining. But after investigating the problem locally, you should use the program destination as (without '): program("sudo docker run -i -v /scripts:/scripts python-test /scripts/test.py");

Br, Micek