[Lxc-users] Debugging a containers firewall.. (syslog)

[Gordon Henderson]

On Thu, 1 Jul 2010, Gordon Henderson wrote:

> Hi,
>
> I'm experimenting with some iptables inside a container - no real issues
> there, it just works, but I'm a little confused by the logging messages..
>
> I'm running rsyslogd and the firewall log messages are going where they'd
> normally go (ie. I've not changed any settings there), so normally I see
> them in the output of dmesg and they're stored in /var/log/kern.log (this
> is Debian and the rsyslogd.conf file has:
>
>   kern.*                          -/var/log/kern.log
>
> However the file kern.log seems to be missing a lot of entires that are
> appearing in the output of dmesg.
>
> I don't currently have kernel timestamps turned on, so I can't properly
> correlate dmesg output with the log-files, but I'm just wondering if there
> is anything significant here - anything obvious I'm missing?

Hm. Following up my own post.. I've just realised the messages are getting 
stored in the hosts kern.log file too, so I'm now confused. Is it actually 
possible to have per-container syslogs, or should it all be done on the 
host? I've no issues with the latter, but there doesn't seem to be a way 
to tag them if the host is doing all the logging... (Although since this 
is firewall, there are DST=i.p.address entries in the hosts kern.log file, 
but that's OK for iptables logging, but not for individual container 
sendmail, etc. logging...

Using Debian stable, kernel 2.6.33.3 and LXC 0.6.5

Cheers,

Gordon