Skip to main content
Welcome to Virtru's support portal. As we work to make this page more accessible to screen readers, please contact us at support@virtru.com for technical support.

Customer Hosted: Gateway Logs

  • Updated

Skip to:

 

Container Level Logs

Logs can be forwarded to a remote host via docker supported protocols.  By default, Docker writes all logs to the Docker Host 

Default log location on host server

var/lib/docker/containers/<containerID>/<containerID>-json.log

Complete documentation on supported logging drivers can be found here: https://docs.docker.com/config/containers/logging/configure/

 

Example:

  • Ubuntu Docker Host
  • Container Name: oe-9001
  • Remote Syslog Server: 192.168.10.15
  • Remote Syslog Server Port: 10514
  • Remote Syslog Transport: TCP
cd /var/virtru/vg/scripts
nano setup-oe-9001.sh

Once inside the script file, modify the logging entries to match:

docker run \
--env-file /var/virtru/vg/env/oe-9001.env \
-v /var/virtru/vg/tls/:/etc/postfix/tls \
-v /var/virtru/vg/queue/oe-9001/:/var/spool/postfix \
-v /var/virtru/vg/dkim/:/etc/opendkim/keys \
--name oe-9001 \
--publish 9001:25 \
--interactive --tty --detach \
--restart unless-stopped \
--log-driver syslog \
--log-opt syslog-address=tcp://192.168.10.15:10514 \
virtru/gateway:<your.gateway.version>

Note:

Make sure you use the proper version in your gateway setup script (ex: virtru/gateway:2.20.0

Host Level Logs

Logs can be read locally and directed to a remote syslog server. 

Note: There will be additional events generated beyond the container logs

Example:

  • Ubuntu Docker Host
  • Remote Syslog Server: 192.168.10.15
  • Remote Syslog Server Port: 10514
  • Remote Syslog Transport: TCP
nano /etc/rsyslog.d/50-default.conf

Add at the top:

*.*  action(type="omfwd" target="192.168.10.15" port="10514" protocol="tcp" action.resumeRetryCount="100" queue.type="linkedList" queue.size="10000")

This will forward all host syslog entries to the remote syslog and retry 100 times and queue up 10000 entries before discarding any.  Due to the nature of TCP, if the remote syslog server is unavailable all entries will be blocked and discarded if the remote server is unavailable and a retry queue is not set.

Related articles