Python脚本通过Syslog向Docker部署的Fluentd发日志无输出求助

Fluentd配置 #

<source>
  @type syslog
  port 514
  bind 0.0.0.0
  tag system
</source>

<match **>
  @type stdout
</match>

Docker启动命令 #

docker run -p 514:514 -v $(pwd)/tmp:/fluentd/etc fluent/fluentd:edge-debian -c /fluentd/etc/fluentd.conf

Fluentd启动日志 #

2023-09-20 16:05:18 +0000 [info]: init supervisor logger path=nil rotate_age=nil rotate_size=nil
2023-09-20 16:05:18 +0000 [info]: parsing config file is succeeded path="/fluentd/etc/fluentd.conf"
2023-09-20 16:05:18 +0000 [info]: gem 'fluentd' version '1.16.2'
2023-09-20 16:05:18 +0000 [warn]: define <match fluent.**> to capture fluentd logs in top level is deprecated. Use <label @FLUENT_LOG> instead
2023-09-20 16:05:18 +0000 [info]: using configuration file: <ROOT>
  <source>
    @type syslog
    port 514
    bind "0.0.0.0"
    tag "system"
  </source>
  <match **>
    @type stdout
  </match>
</ROOT>
2023-09-20 16:05:18 +0000 [info]: starting fluentd-1.16.2 pid=7 ruby="3.1.4"
2023-09-20 16:05:18 +0000 [info]: spawn command to main:  cmdline=["/usr/local/bin/ruby", "-Eascii-8bit:ascii-8bit", "/usr/local/bundle/bin/fluentd", "-c", "/fluentd/etc/fluentd.conf", "--plugin", "/fluentd/plugins", "--under-supervisor"]
2023-09-20 16:05:19 +0000 [info]: #0 init worker0 logger path=nil rotate_age=nil rotate_size=nil
2023-09-20 16:05:19 +0000 [info]: adding match pattern="**" type="stdout"
2023-09-20 16:05:19 +0000 [info]: adding source type="syslog"
2023-09-20 16:05:19 +0000 [warn]: #0 define <match fluent.**> to capture fluentd logs in top level is deprecated. Use <label @FLUENT_LOG> instead
2023-09-20 16:05:19 +0000 [info]: #0 starting fluentd worker pid=16 ppid=7 worker=0
2023-09-20 16:05:19 +0000 [info]: #0 listening syslog socket on 0.0.0.0:514 with udp
2023-09-20 16:05:19 +0000 [info]: #0 fluentd worker is now running worker=0
2023-09-20 16:05:19.058192424 +0000 fluent.info: {"pid":16,"ppid":7,"worker":0,"message":"starting fluentd worker pid=16 ppid=7 worker=0"}
2023-09-20 16:05:19.058414751 +0000 fluent.info: {"message":"listening syslog socket on 0.0.0.0:514 with udp"}
2023-09-20 16:05:19.059112948 +0000 fluent.info: {"worker":0,"message":"fluentd worker is now running worker=0"}

Python测试脚本 #

import logging
import logging.handlers
import socket

if __name__ == "__main__":
    syslogger = logging.getLogger('SyslogLogger')
    handler = logging.handlers.SysLogHandler(address=("0.0.0.0", 514), facility=19, socktype=socket.SOCK_DGRAM)
    syslogger.addHandler(handler)
    syslogger.info("Hello World")

问题现象 #

脚本运行无报错，但Fluentd端未收到任何日志，服务器与脚本均在本地机器上。

解决方案 #

1. 修正SyslogHandler目标地址 #

Python脚本中SysLogHandler的address参数填"0.0.0.0"错误，0.0.0.0表示监听所有网卡，而非目标地址。本地Docker服务应使用"localhost"或主机实际IP：

handler = logging.handlers.SysLogHandler(address=("localhost", 514), facility=19, socktype=socket.SOCK_DGRAM)

2. 启用INFO级别日志 #

默认logging.getLogger()的日志级别为WARNING，info级别的日志会被过滤，需手动设置级别：

syslogger.setLevel(logging.INFO)

3. 完整修正后的脚本 #

import logging
import logging.handlers
import socket

if __name__ == "__main__":
    syslogger = logging.getLogger('SyslogLogger')
    syslogger.setLevel(logging.INFO)
    handler = logging.handlers.SysLogHandler(address=("localhost", 514), facility=19, socktype=socket.SOCK_DGRAM)
    syslogger.addHandler(handler)
    syslogger.info("Hello World")

4. 确认端口映射类型 #

从启动日志可知Fluentd监听UDP端口，Docker启动命令-p 514:514默认同时映射TCP和UDP，若需明确可改为-p 514:514/udp。

内容的提问来源于stack exchange，提问作者Jayendra Parmar