Lee Hill's questions

new to docker....

so got a few containers running and i want to run a logging container to collect all the logs up and send them to Rapid7.

the rapid7 container is working as its sending stats to the remote syslog.

BUT... it is not sending container logs...

using the hello-world container to create a test container log as its simple.

docker run hello-world 

then look at the logs:

docker logs compassionate_chaum

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

shows the standard output, great. but it doesn't appear on my remote log?

what am i missing?

so, playing with centralized logging and i just cannot get syslogd to send the messages to a remote syslog server.

background:

syslog server is setup and working, tested with other devices sending logs into it.

networking both server and client reside in the same subnet, firewalls are off on server, from what i can tell ubuntu has no firewall configured. tested 514 open on the server from the client and get a successful connection.

setup/test process

syslogd didn't seem to exist on my install, so i installed it:

sudo apt-get install -y inetutils-syslogd

modified the config file in /etc/syslogd.conf to include 2 lines:

*.* /home/lee/test
*.* @10.120.1.20

saved and reloaded syslogd by sending the hangup signal

killall -s SIGHUP syslogd

testing with the logger function:

logger "test"

inserts lines into the local file, but nothing gets to the server.

tried setting up a tcpdump on 512 outbound to see if anything is going through:

tcpdump -n -s 1500 -X port 514 -w /home/lee/tcpdump.pcap

the file is empty, tried tracing the PID as such:

strace -s 500 -tfp 188341 -o /home/lee/strace_syslog

the output of the file indicates it sees the test messages, and writes to some outputs, but nothing seems to indicate writing out to the remote syslog address...

1446  10:27:52 restart_syscall(<... resuming interrupted poll ...>) = 1
1446  10:28:03 recvfrom(21, "<13>May 18 10:28:03 lee: test", 1024, 0, 0x7ffd918070e0, [110->0]) = 29
1446  10:28:03 rt_sigprocmask(SIG_BLOCK, [HUP ALRM], [], 8) = 0
1446  10:28:03 writev(22, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446  10:28:03 writev(20, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446  10:28:03 writev(11, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446  10:28:03 writev(6, [{iov_base="May 18 10:28:03", iov_len=15}, {iov_base=" ", iov_len=1}, {iov_base="ubuntu-docker", iov_len=13}, {iov_base=" ", iov_len=1}, {iov_base="lee: test", iov_len=9}, {iov_base="\n", iov_len=1}], 6) = 40
1446  10:28:03 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
1446  10:28:03 poll([{fd=3, events=POLLIN|POLLPRI}, {fd=21, events=POLLIN|POLLPRI}], 2, -1) = ? ERESTART_RESTARTBLOCK (Interrupted by signal)
1446  10:28:10 --- SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL} ---
1446  10:28:10 alarm(30)                = 0
1446  10:28:10 rt_sigreturn({mask=[]})  = -1 EINTR (Interrupted system call)
1446  10:28:10 poll([{fd=3, events=POLLIN|POLLPRI}, {fd=21, events=POLLIN|POLLPRI}], 2, -1) = ? ERESTART_RESTARTBLOCK (Interrupted by signal)
1446  10:28:40 --- SIGALRM {si_signo=SIGALRM, si_code=SI_KERNEL} ---
1446  10:28:40 alarm(30)                = 0
1446  10:28:40 rt_sigreturn({mask=[]})  = -1 EINTR (Interrupted system call)

what have i missed???

i just cannot get it to output to a remote host.... from my testing i am confident that it is a configuration issue in /etc/syslogd.conf but i cannot see what!

First question so please be kind!

issue: in the google cloud platform they block traffic on port 25 outbound to external addresses.

• 1 webserver needing to send mail via my corporate mail server.
• 1 mail server sitting inside my DMZ, that is routed on the firewall.
• 1 site to site VPN (on the firewall) between my office subnet and the GCP local subnet.

what i know so far:

So... after a day of being convinced that there was an issue with my firewall, turns out that google block outbound ports 25, 465 and 587. (all variations of SMTP protocol ports)

Found that nugget here: https://cloud.google.com/compute/docs/tutorials/sending-mail/

it describes here how the traffic is allowed between local networks but blocked from the internet.

Now, I have a Site-to-Site VPN setup between the GCP and my ASA5520 which is working great, there are routes for my local networks in GCP, to route it through. now is this considered part of the "local Network" or is restricted to the local subnet of the Google Instance?

I guess somebody must of come across this problem before me, with a similar setup, but i cannot find much.

Before a make changes to my live firewall to try and allow traffic to the DMZ from the VPN, i would like to know if anybody has any experience in this?

Also open to other suggestions on how to solve my problem... although i would rather not have to pay for anything, or rely on apps and other services.

cheers!