search

datalust / seq-input-gelf

Ingest GELF payloads into Seq
https://datalust.co/seq
Apache License 2.0
15 stars 8 forks source link

sqelf in Docker doesn't listen on 12201/TCP #85

Closed rjhenry closed 3 years ago

rjhenry commented 3 years ago

Despite the README's claim that it can ingest GELF via UDP or TCP, the Docker image only listens on the UDP socket.

$ k exec -it -n adt-system seq-gelf-translator-64b78f6559-tvxhl -- bash -c "apt update; apt install -y iproute2; ss -nlp | grep sqelf; echo Done"
Hit:1 http://archive.ubuntu.com/ubuntu bionic InRelease
Hit:2 http://archive.ubuntu.com/ubuntu bionic-updates InRelease
Hit:3 http://archive.ubuntu.com/ubuntu bionic-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu bionic-security InRelease
Reading package lists... Done                      
Building dependency tree       
Reading state information... Done
31 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists... Done
Building dependency tree       
Reading state information... Done
iproute2 is already the newest version (4.15.0-2ubuntu1.3).
0 upgraded, 0 newly installed, 0 to remove and 31 not upgraded.
udp  UNCONN 0      0                                          0.0.0.0:12201                     0.0.0.0:*              users:(("sqelf",pid=7,fd=6))             
Done
KodrAus commented 3 years ago

Hi @rjhenry :wave:

What do you get from docker inspect for that container image? Are you setting the GELF_ADDRESS environment variable with a tcp:// prefix? The server will listen on UDP by default, unless we specify TCP in the address to bind. This is just for backwards compatibility reasons, and could probably be better spelled out in the readme.

rjhenry commented 3 years ago

I'm running this on top of containerd in a Kubernetes cluster; there's no docker installed! Inspecting with containerd's info tool gives the following:

# microk8s.ctr c info
e382338439ef0352901abe97a04c5714fc6ff3aeec46f2f65f189bb5b3656b14 | grep
-i gelf
        "io.kubernetes.container.name": "seq-input-gelf",
        "io.kubernetes.pod.name": "seq-gelf-translator-647b8ff5d7-m92pw",
    "Image": "docker.io/datalust/seq-input-gelf:2.0",
                "HOSTNAME=seq-gelf-translator-647b8ff5d7-m92pw",
                "GELF_ADDRESS=",
                "SEQ_GELF_TRANSLATOR_PORT_12201_TCP_PROTO=tcp",
                "SEQ_GELF_TRANSLATOR_PORT_12201_TCP_ADDR=10.152.183.65",
                "SEQ_GELF_TRANSLATOR_PORT_12201_TCP_PORT=12201",
                "SEQ_GELF_TRANSLATOR_SERVICE_HOST=10.152.183.65",
                "SEQ_GELF_TRANSLATOR_PORT=tcp://10.152.183.65:12201",
                "LOGSTASH_SERVICE_PORT_GELF_TCP=8081",
                "SEQ_GELF_TRANSLATOR_SERVICE_PORT_GELF_TCP=12201",
                "SEQ_GELF_TRANSLATOR_SERVICE_PORT=12201",

"SEQ_GELF_TRANSLATOR_PORT_12201_TCP=tcp://10.152.183.65:12201",
                "source":
"/var/snap/microk8s/common/var/lib/kubelet/pods/ca94cfaf-a628-4448-be8c-174e8ed45294/containers/seq-input-gelf/7df8e178",

I'll give it a go specifying a tcp:// prefix. I've just re-read the README and it does specify that is should be set to either tcp:// or udp://, whereas when I first read the documentation I read that as it supports either!

I think this is solidly user error, but will test and let you know before closing the issue.

rjhenry commented 3 years ago

I'm still seeing issues, but I think that they may be at the orchestration level and not the container level. Many thanks!

KodrAus commented 3 years ago

No problem! If you are running into more issues I’d love to hear about them and anything we can do to improve the experience 🙂 It can be tricky for us to run in all the different shaped environments ourselves so user reports are really valuable.