. ├── docker-compose.yml ├── log │ ├── demo-v2-66 │ │ ├── daemon-20250507.log │ │ └── kern-20250507.log │ ├── demo-v2-67 │ │ ├── authpriv-20250507.log │ │ ├── daemon-20250507.log │ │ └── kern-20250507.log : : │ ├── demo-v2-79 │ │ ├── auth-20250507.log │ │ ├── authpriv-20250507.log │ │ ├── daemon-20250507.log │ │ ├── kern-20250507.log │ │ ├── syslog-20250507.log │ │ └── user-20250507.log │ ├── messages │ └── messages-kv.log └── syslog-ng └── config ├── log │ ├── current │ ├── lock │ └── state ├── syslog-ng.conf ├── syslog-ng.ctl ├── syslog-ng.persist └── syslog-ng.pid
services:
syslog-ng:
image: lscr.io/linuxserver/syslog-ng:latest
container_name: syslog-ng
environment:
- PUID=1000
- PGID=1000
- TZ=Asia/Taipei
- LOG_TO_STDOUT= #optional
volumes:
- ./syslog-ng/config:/config
- ./log:/var/log #optional
ports:
- 514:5514/udp
- 601:6601/tcp
- 6514:6514/tcp
restart: unless-stopped
https://raw.githubusercontent.com/tryweb/docker-compose/refs/heads/main/syslog-ng/docker-compose.yml
#############################################################################
# syslog-ng.conf file configured to collect logs from different hosts
# into separate directories and rotate logs to keep for 3 months
@version: 4.2
@include "scl.conf"
options {
time_reopen(10);
chain_hostnames(off);
keep_hostname(yes);
flush_lines(0);
use_dns(no);
use_fqdn(no);
create_dirs(yes);
keep_timestamp(yes);
};
source s_local {
internal();
};
source s_network_tcp {
syslog(transport(tcp) port(6601));
};
source s_network_udp {
syslog(transport(udp) port(5514));
};
# 原有的本地日誌目的地
destination d_local {
file("/var/log/messages");
file("/var/log/messages-kv.log" template("$ISODATE $HOST $(format-welf --scope all-nv-pairs)\n") frac-digits(3));
};
# 新增：按照主機 IP 分類的目的地，並加入日誌輪替功能
destination d_per_host {
file(
"/var/log/$HOST/$FACILITY-$YEAR$MONTH$DAY.log"
template("$ISODATE $LEVEL $PROGRAM $MSG\n") # 使用 $PROGRAM 顯示 Docker 的 tag
create_dirs(yes)
dir_perm(0755)
perm(0644)
owner("root")
group("root")
overwrite_if_older(7776000) # 90天 = 90 * 24 * 60 * 60 = 7,776,000秒
);
};
# 本地日誌處理
log {
source(s_local);
destination(d_local);
};
# 網絡日誌處理：按主機分類
log {
source(s_network_tcp);
source(s_network_udp);
destination(d_per_host);
};
docker compose pull docker compose up -d
fdisk /dev/sdbpvcreate /dev/sdb1 vgcreate vglogdata /dev/sdb1 lvcreate -l +100%FREE -nlogdata vglogdata mkfs.ext4 /dev/vglogdata/logdata
mkdir -p /logdata chown 1000:1000 /logdata vi /etc/fstab
: /dev/vglogdata/logdata /logdata ext4 rw 0 1
mount /logdata df -h
vi docker-compose.yml:
volumes:
- ./syslog-ng/config:/config
- /logdata:/var/log #optional
:
docker compose down
cp -a ./log/* /logdata/ ln -s /logdata .
docker compose up -d