Docker container sshd logs

Question

How to enable ssh connections log (/var/log/auth.log) in a Docker container with openssh-server?

The /var/log/auth.log not exists in my container.

• Docker version: 9.0
• Host: Ubuntu 13.10
• Container: Ubuntu 13.10

Answer 1

The auth log is managed by the Syslog service. This service itself is traditionally managed (started) by the init system (Upstart in your case). By default a container doesn't run an init system, meaning that you'd have to start rsyslog manually :

# rsyslogd

After that, you'll find your usual log files in /var/log.

NB: init systems are not fully compatible with Docker containers. A common practice is to use Supervisord to start multiple services/processes automatically.

Answer 2

Install the rsyslog package in the docker container:

$ apt-get install rsyslog

then start the daemon:

$ service rsyslog start

It seems a message such as below can be ignored, sshd logs to /var/log/auth.log anyway.

 * Starting enhanced syslogd rsyslogd                                                                                                                                                                                                           
rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [v8.32.0 try http://www.rsyslog.com/e/2145 ]