As far as I can tell, as long as you submit a properly formatted URL for --log-opt syslog-address, Docker opens a UDP connection to the local syslog agent. I cannot make Docker send syslog data to any other endpoint. Here’s an example:
[root@staging-us1-ecs-uswest2-i-066245814:/etc]# dockerd -g /mnt/containers --log-driver=syslog --log-opt syslog-address=tcp://123.123.123.123:514
INFO[0000] libcontainerd: new containerd process, pid: 53098
INFO[0001] [graphdriver] using prior storage driver "aufs"
INFO[0001] Graph migration to content-addressability took 0.00 seconds
WARN[0001] Your kernel does not support swap memory limit.
INFO[0001] Loading containers: start.
...............................................................................................................................................INFO[0001] Firewalld running: false
INFO[0001] Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set a preferred IP address
INFO[0002] Loading containers: done.
INFO[0002] Daemon has completed initialization
INFO[0002] Docker daemon commit=78d1802 graphdriver=aufs version=1.12.6
INFO[0002] API listen on /var/run/docker.sock
[root@staging-us1-ecs-uswest2-i-066245814:~]# lsof -p $(pgrep dockerd) | egrep -i 'tcp|udp|log'
dockerd 53092 root 16u IPv4 22362288 0t0 UDP localhost:64008->localhost:syslog
[root@staging-us1-ecs-uswest2-i-066245814:~]#
I have tried many variations of the syslog-address option… I’ve proven that the code in https://github.com/moby/moby/blob/v1.12.6/daemon/logger/syslog/syslog.go#L151-L181 properly detects improperly formatted URLs. However, nothign I do seems to get Docker Engine to send TCP (or what I really want, unixdgram) syslog messages. It always uses UDP.
Anyone else seeing this? I’ve tested with Docker Engine 1.12.6 as well as the latest 17.05.0~ce-0~ubuntu-trusty
This is on Ubuntu 14.04 by the way.