[lxc-devel] Containerized syslog

[Daniel Lezcano]

Jean-Philippe Menil wrote:
> Hi,
>
> I'm playing with containers under debian (squeeze, 2.6.33.3) with the 
> lxc tools.
> I'm really happy about all the features (attach veth on bridge, filter 
> with iptables inside the containers, etc ...), and i was thinking to 
> replace some of our vservers (and maybe some of our kvm) with this 
> solution.
>
> But actually, i experiment a problem with the iptables logs:
> i've iptables on the host to filter some container, basically a squid 
> proxy. I've another container who act as router, and he has his own 
> iptables inside.
> All the log are deported to a dedicated syslog server.
> It appear that, the iptables log of the host are also deported by the 
> syslog container (proxy).
>
> Some of our guest (container, vserver, etc ) are administer by other 
> sys-admin, that should not have access to theses informations.
>
> This point is blocking me today, before going into production with 
> containers.
>
> I've seen some patch made by Jean-Marc Pigeon about this problem,
> but they have not been commited.

I thing a consensus was not reach. The big deal with syslog is netfilter 
logs in an interrupt context where it is difficult to find the right log 
buffer ring as we are not in the process context making possible to 
identify the namespace.

IMHO, there are two parts to implement, (1) multiple instances of 
/dev/log with a new ring buffer each time attached to the file and (2) 
add an iptables rules to specify the file to log. This approach allows 
to get rid of namespace (in all the cases the clone flags are exhausted 
now), and provides a generic mechanism for other use cases (eg. separate 
logs for iptables) different from a container specific problem.

This is from a kernel POV, but from the userspace POV, that will means 
the iptables rules in the vps configuration files should be modified, I 
don't know if it's acceptable.
> Is there any reason for that?
> Can someone advice me to circumvent this problem?
I don't know a workaround for this problem.

Thanks
  -- Daniel