containers / containers/conmon

adding support to forward containers output to splunk via hec connector

Open
#340 10 comments 5 reactions 0 assignees View on GitHub
Dominant language
C
Stars
499
Forks
150
Avg merge
1d 10h
Merged PRs (30d)
20

Description

We do currently use docker on Debian 11 and let the containers log on stdout through the
Splunk logging driver (https://docs.docker.com/config/containers/logging/splunk/) via HEC (https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector) into Splunk.

In term of docker-compose this gives us the possibility to configure Splunk-logging on a per deployment basis, which is very comfortable as well as independent of any central configuration.

We would like to move to Podman on RHEL8 servers. Everything works fine so far, but we didn't find a way to log stdout of the containers via the HEC interface into Splunk, as the currently available podman version 4 does not provide such a splunk logging driver.

Is there a solution on the part of Podman to log the output of the containers into Splunk.

If not, is it possible to commission a corresponding development against payment?

I opened a feature request in the [podman repo](https://github.com/containers/podman/issues/14432) and I was told to open the request in this repo.

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no conmon files, tests, or entry points. Start by reviewing how container stdout is currently handled and whether the requested Splunk HEC logging-driver behavior fits conmon; done would require an agreed implementation scope and a demonstrated forwarding path.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, linux
Domain
devops, observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.