title: Docker swarm - log to rsyslog container
body: <p>I have a docker swarm with 6 services that I want to have logging to one central logging container.
  I have this working in my dev environment (non swarm) - see the docker-compose file below.</p>
  
  <p>When I try to transition the configuration from the dev env to my swarm prod env, it fails.</p>
  
  <p>first I raise the log service:</p>
  
  <pre><code>docker service create --replicas 1 \
  --name logserver \
  --network phototankswarm \
  --constraint=node.hostname==pi2 \
  -p localhost:5514:514 \
  kaninfod/pt-syslog
  </code></pre>
  
  <p>This runs up nicely.</p>
  
  <p>Then one of the services (e.g a redis):</p>
  
  <pre><code>docker service create --replicas 1 \
  --name redis \
  --network phototankswarm \
  --constraint=node.hostname==pi1 \
  --log-driver=syslog \
  --log-opt syslog-facility="daemon" \
  --log-opt tag="rails" \
  --log-opt syslog-address="tcp://localhost:5514" \
  -p 6379:6379 \
  armhf/redis
  </code></pre>
  
  <p>And this fails with:</p>
  
  <pre><code>starting container failed: Failed to initialize logging driver: dial tcp [::1]:5514: getsockopt: connection refused
  </code></pre>
  
  <p>I had problems with the syslog-address when setting up the dev env...I find it strange that I have to use the localhost rather than the docker dns name of the log container...but en dev it works with localhost.</p>
  
  <p>This is the compose file I use for my dev env:</p>
  
  <pre><code>version: '3'
  
  services:
    nginx:
      image: nginx
      depends_on:
        - api
        - syslog
      ports:
        - "80:8080"
  
      logging:
        driver: syslog
        options:
          syslog-facility: "daemon"
          tag: "nginx"
          syslog-address: "tcp://localhost:5514"
      networks:
        - phototankswarm
      env_file: .env.dev
      volumes:
        - ./frontend/nginx/conf.d:/etc/nginx/conf.d
        - ./frontend/public:/www
  
    db:
      image: mysql
      env_file: .env.dev
      depends_on:
        - syslog
      networks:
        - phototankswarm
      ports:
        - "3306:3306"
      volumes:
        - ./sql/data:/var/lib/mysql
      logging:
        driver: syslog
        options:
          syslog-facility: "daemon"
          tag: "mysql"
          syslog-address: "tcp://localhost:5514"
  
    redis:
      image: redis
      depends_on:
        - syslog
      networks:
        - phototankswarm
      logging:
        driver: syslog
        options:
          syslog-facility: "daemon"
          tag: "redis"
          syslog-address: "tcp://localhost:5514"
  
    api:
      image: pt-rails
      env_file: .env.dev
      networks:
        - phototankswarm
      command: &gt;
        sh -c '
        bundle exec sidekiq -d &amp;&amp; bundle exec rails s -p 3000 -b 0.0.0.0
        '
      volumes:
        - /Users/martinhinge/Pictures/docker/phototank:/media/phototank
        - ./backend:/usr/src/app
      ports:
        - "3000:3000"
      depends_on:
        - db
        - redis
        - syslog
      logging:
        driver: syslog
        options:
          syslog-facility: "daemon"
          tag: "rails"
          syslog-address: "tcp://localhost:5514"
  
    syslog:
      image: syslog
      ports:
        - "localhost:5514:514"
      networks:
        - phototankswarm
      volumes:
        - /tmp:/var/log/syslog
  
  networks:
    phototankswarm:
  </code></pre>
  
  <p><strong>EDIT</strong></p>
  
  <p>running <code>$ docker run -it --rm --net container:dac082edcd6f hypriot/rpi-alpine-scratch netstat -lnt</code> yields:</p>
  
  <pre><code>Active Internet connections (only servers)
  Proto Recv-Q Send-Q Local Address           Foreign Address         State       
  tcp        0      0 127.0.0.11:35314        0.0.0.0:*               LISTEN      
  tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      
  tcp        0      0 :::514                  :::*                    LISTEN  
  </code></pre>