rsyslog/rsyslog-collector repository overview

⁠rsyslog/rsyslog-collector

rsyslog/rsyslog-collector is the central receiver role in the rsyslog container image family.

⁠What it is for

Use this image when you want to:

• receive syslog traffic in a container
• build a central log collector or relay service
• start from a reusable rsyslog receiver image and add your own routing rules

⁠Default behavior

The image:

• listens on UDP syslog (514/udp) by default
• listens on TCP syslog (514/tcp) by default
• can enable RELP on 2514/tcp
• can enable TLS syslog on 6514/tcp
• writes received messages to local files by default

⁠Useful environment variables

• ENABLE_UDP: enable UDP syslog reception, default on
• ENABLE_TCP: enable TCP syslog reception, default on
• ENABLE_RELP: enable RELP reception, default off
• ENABLE_TLS: enable TLS syslog reception, default off
• WRITE_ALL_FILE: write /var/log/all.log, default on
• WRITE_JSON_FILE: write /var/log/all-json.log, default on
• TLS_CA_FILE, TLS_CERT_FILE, TLS_KEY_FILE, TLS_AUTH_MODE: TLS listener settings

⁠Notes

The packaged configuration writes to local files. You can mount additional rules into /etc/rsyslog.d/ to forward to other backends or reshape the pipeline.

Documentation: https://www.rsyslog.com/doc/containers/collector.html⁠