Add support to forward containers output to splunk via hec connector

[dbloms]

We do currently use docker on Debian 11 and let the containers log on stdout through the Splunk logging driver (https://docs.docker.com/config/containers/logging/splunk/) via HEC (https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector) into Splunk.

In term of docker-compose this gives us the possibility to configure Splunk-logging on a per deployment basis, which is very comfortable as well as independent of any central configuration.

We would like to move to Podman on RHEL8 servers. Everything works fine so far, but we didn't find a way to log stdout of the containers via the HEC interface into Splunk, as the currently available podman version 4 does not provide such a splunk logging driver.

Is there a solution on the part of Podman to log the output of the containers into Splunk.

If not, is it possible to commission a corresponding development against payment?

I opened a feature request in the https://github.com/containers/conmon/issues/340 and I was told to open the request in this repo.

[haircommander]

Thanks for opening the issue! the team is going to start by focusing on adding support in podman for conmon-rs, as that will be a required first-step. Once that's done, we can evaluate the work needed for this. In the meantime, anyone can chime in if they're interested in implementing this

[chillout2k]

We do also use the the splunk logging driver in our docker deployments and we would be very pleased if podman/conmon would support it too. From my point of view this logging driver is an important feature to make podman a real drop-in-replacement for docker in (splunk-specific) production environments.

Thanks in advance :)

[deeninetyone]

Bumping this, as I'm also looking for a better solution than scraping the container logfiles. Is this still waiting on podman changes? Is there a ticket in the podman repo for that?

[haircommander]

This still needs conmon-rs changes as well as podman changes. still a lot of work to do here

[mehdik2023]

Raising this issue again, this really need to be implemented or at least have some sort of workaround for it.

[saschagrunert]

@mehdik2023 thank you for the ping! Do you plan to contribute the feature? Right now it seems no real priority for the project but we may raise it since multiple folks looking forward to a solution right now.