Docker : neuvième pas

Attention ceci est mon brouillon avant de faire une belle documentation sur Docker (il y a à boire et à manger). Sachant que celui-ci c’est 100% échec 🙁 .

Cette fois je vais m’attaquer au logs, et pour ce faire je vais monter un container faisant uniquement du syslog. Voici l’architecture cible que je veux :

Capture d’écran 2016-04-22 à 09.53.32

Je vais partir sur un ubuntu pour faire plus simple.

[root@localhost ~]# cat Dockerfile
FROM ubuntu:14.04
RUN apt-get update -q
RUN apt-get install rsyslog
CMD rsyslogd -n
VOLUME /dev
VOLUME /var/log
[root@localhost ~]# docker build -t syslog .
Sending build context to Docker daemon 132.1 kB
Step 1 : FROM ubuntu:14.04
14.04: Pulling from library/ubuntu
759d6771041e: Pull complete 
8836b825667b: Pull complete 
c2f5e51744e6: Pull complete 
a3ed95caeb02: Pull complete 
Digest: sha256:28fd745dfe0a5f6e716437969c4927c2b4e44c13ce4230205e990608048edb6d
Status: Downloaded newer image for ubuntu:14.04
 ---> b72889fa879c
Step 2 : RUN apt-get update -q
 ---> Running in 2463796467f8
Ign http://archive.ubuntu.com trusty InRelease
Get:1 http://archive.ubuntu.com trusty-updates InRelease [65.9 kB]
Get:2 http://archive.ubuntu.com trusty-security InRelease [65.9 kB]
Hit http://archive.ubuntu.com trusty Release.gpg
Hit http://archive.ubuntu.com trusty Release
Get:3 http://archive.ubuntu.com trusty-updates/main Sources [344 kB]
Get:4 http://archive.ubuntu.com trusty-updates/restricted Sources [5217 B]
Get:5 http://archive.ubuntu.com trusty-updates/universe Sources [193 kB]
Get:6 http://archive.ubuntu.com trusty-updates/main amd64 Packages [948 kB]
Get:7 http://archive.ubuntu.com trusty-updates/restricted amd64 Packages [23.5 kB]
Get:8 http://archive.ubuntu.com trusty-updates/universe amd64 Packages [463 kB]
Get:9 http://archive.ubuntu.com trusty-security/main Sources [141 kB]
Get:10 http://archive.ubuntu.com trusty-security/restricted Sources [3920 B]
Get:11 http://archive.ubuntu.com trusty-security/universe Sources [40.9 kB]
Get:12 http://archive.ubuntu.com trusty-security/main amd64 Packages [570 kB]
Get:13 http://archive.ubuntu.com trusty-security/restricted amd64 Packages [20.2 kB]
Get:14 http://archive.ubuntu.com trusty-security/universe amd64 Packages [165 kB]
Get:15 http://archive.ubuntu.com trusty/main Sources [1335 kB]
Get:16 http://archive.ubuntu.com trusty/restricted Sources [5335 B]
Get:17 http://archive.ubuntu.com trusty/universe Sources [7926 kB]
Get:18 http://archive.ubuntu.com trusty/main amd64 Packages [1743 kB]
Get:19 http://archive.ubuntu.com trusty/restricted amd64 Packages [16.0 kB]
Get:20 http://archive.ubuntu.com trusty/universe amd64 Packages [7589 kB]
Fetched 21.7 MB in 2min 26s (148 kB/s)
Reading package lists...
 ---> 11e4b9b06a05
Removing intermediate container 2463796467f8
Step 3 : RUN apt-get install rsyslog
 ---> Running in e16959050268
Reading package lists...
Building dependency tree...
Reading state information...
rsyslog is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.
 ---> ec6b5ccfe8c0
Removing intermediate container e16959050268
Step 4 : CMD rsyslogd -n
 ---> Running in 79e4a4eb00ff
 ---> 8ec0c5bb60d0
Removing intermediate container 79e4a4eb00ff
Step 5 : VOLUME /dev
 ---> Running in 347f8c6ade7e
 ---> 6420e9f77fba
Removing intermediate container 347f8c6ade7e
Step 6 : VOLUME /var/log
 ---> Running in de699807136f
 ---> be5bde4d6a85
Removing intermediate container de699807136f
Successfully built be5bde4d6a85
[root@localhost ~]# docker run --name syslog -d -v /tmp/syslogdev:/dev syslog
867a66d50ef7e8445955fe782592b628249ebeb6dfa80049e84a63d858ae2f54
docker: Error response from daemon: Container command '/bin/sh' not found or does not exist..
[root@localhost ~]# cat Dockerfile
FROM ubuntu:14.04
RUN apt-get update -q
RUN apt-get install rsyslog
RUN ln -snf /bin/bash /bin/sh
CMD rsyslogd -n
VOLUME /dev
VOLUME /var/log
[root@localhost ~]# docker build -t syslog2 .
Sending build context to Docker daemon 132.1 kB
Step 1 : FROM ubuntu:14.04
 ---> b72889fa879c
Step 2 : RUN apt-get update -q
 ---> Using cache
 ---> 11e4b9b06a05
Step 3 : RUN apt-get install rsyslog
 ---> Using cache
 ---> ec6b5ccfe8c0
Step 4 : RUN ln -snf /bin/bash /bin/sh
 ---> Running in 0fd64938ee85
 ---> 2c174cff7707
Removing intermediate container 0fd64938ee85
Step 5 : CMD rsyslogd -n
 ---> Running in 5fc415eaf75a
 ---> 16390b94ad90
Removing intermediate container 5fc415eaf75a
Step 6 : VOLUME /dev
 ---> Running in 308f5e2d6f4e
 ---> ed81f91fcda0
Removing intermediate container 308f5e2d6f4e
Step 7 : VOLUME /var/log
 ---> Running in 4daa6d206e65
 ---> 0bf88dc8c124
Removing intermediate container 4daa6d206e65
Successfully built 0bf88dc8c124
[root@localhost ~]# docker run --name syslog2 -d -v /tmp/syslogdev:/dev syslog2
1cd650a2bc99db13cea2561d25c68f4f5906110eb7659b62fe70cbb217ab1e4c
docker: Error response from daemon: Container command '/bin/sh' not found or does not exist..

Finalement je vais garder Fédora 😉 Misère. Ou alors je vais prendre une image minimale sur GitHub :

[root@localhost ~]# docker run -d -p 127.0.0.1:514:514/udp -v /var/log/syslog-ng:/var/log/syslog-ng --name syslog-ng bobrik/syslog-ng
Unable to find image 'bobrik/syslog-ng:latest' locally
latest: Pulling from bobrik/syslog-ng
c862d82a67a2: Pull complete 
41325d62a122: Pull complete 
b986d6a20615: Pull complete 
c91b20352765: Pull complete 
a3ed95caeb02: Pull complete 
Digest: sha256:c4067389b0e3846438a22856c731158b5ce35bdee691756c48feb4e557240597
Status: Downloaded newer image for bobrik/syslog-ng:latest
698b673be5ac4f0b0b1d2f0c7b8e040b44f183c55171b946a9e592dba439fe49

Ensuite on va modifier la configuration de HAproxy pour envoyer les logs dans ce container.

J’aurais pu utiliser d’autres techniques mais j’aime bien savoir que tous les logs sont au même endroit. Cela permet de recouper plus facilement les informations. Par exemple en faisant des liens :

RUN ln -sf /dev/stdout /var/log/nginx/access.log 
RUN ln -sf /dev/stderr /var/log/nginx/error.log

Mais je préfère l’idée du container à logs. On sais que c’est uniquement que lui qui va grossir et plus d’avoir des recoupements simplifiés.
Avec la configuration modifié cela donne :

[root@localhost ~]# cat haproxy.cfg 
global
    maxconn 400

defaults
    log syslog-ng global
    mode    tcp
    option  tcplog
    option  dontlognull
    retries 4
    maxconn 200
    timeout connect  5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80	
    log syslog-ng local0	
    default_backend serveur

backend serveur
        mode tcp
        balance roundrobin
        server server1 my-server4-1:80
        server server2 my-server4-2:80
        server server3 my-server4-3:80
        server server4 my-server4-4:80

[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                             NAMES
698b673be5ac        bobrik/syslog-ng    "/usr/sbin/syslog-ng "   3 minutes ago       Up 3 minutes        514/tcp, 127.0.0.1:514->514/udp   syslog-ng
78f6bc54152e        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8083->80/tcp              my-server4-4
fce6865343f1        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8082->80/tcp              my-server4-3
a75937eb980d        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8081->80/tcp              my-server4-2
eacf3e4bc897        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8080->80/tcp              my-server4-1
2fc533c55725        postgres            "/docker-entrypoint.s"   16 hours ago        Up 16 hours         0.0.0.0:5432->5432/tcp            postgres2
[root@localhost ~]# docker run -d --link my-server4-1 --link my-server4-2 --link my-server4-3 --link my-server4-4 --link syslog-ng -p 80:80 --name mon-haproxy-v16 my-haproxy-v15
ebbe54ce6794f7075f9a43c30903f508c2200098ccd2f530b7925c131e94e56e
[root@localhost ~]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

HELLO
IP

eth0
QUIT
Connection closed by foreign host.
[root@localhost ~]# docker logs 698b673be5ac
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED              STATUS              PORTS                             NAMES
ebbe54ce6794        my-haproxy-v15      "/docker-entrypoint.s"   About a minute ago   Up About a minute   0.0.0.0:80->80/tcp                mon-haproxy-v16
698b673be5ac        bobrik/syslog-ng    "/usr/sbin/syslog-ng "   5 minutes ago        Up 5 minutes        514/tcp, 127.0.0.1:514->514/udp   syslog-ng
78f6bc54152e        my-server4          "/sbin/server4"          6 hours ago          Up 6 hours          0.0.0.0:8083->80/tcp              my-server4-4
fce6865343f1        my-server4          "/sbin/server4"          6 hours ago          Up 6 hours          0.0.0.0:8082->80/tcp              my-server4-3
a75937eb980d        my-server4          "/sbin/server4"          6 hours ago          Up 6 hours          0.0.0.0:8081->80/tcp              my-server4-2
eacf3e4bc897        my-server4          "/sbin/server4"          6 hours ago          Up 6 hours          0.0.0.0:8080->80/tcp              my-server4-1
2fc533c55725        postgres            "/docker-entrypoint.s"   16 hours ago         Up 16 hours         0.0.0.0:5432->5432/tcp            postgres2
[root@localhost ~]# docker logs ebbe54ce6794
haproxy-systemd-wrapper: executing /usr/local/sbin/haproxy -p /run/haproxy.pid -f /usr/local/etc/haproxy/haproxy.cfg -Ds 

Je vais essayer sur un autre port …

[root@localhost ~]# docker stop syslog-ng
syslog-ng
[root@localhost ~]# docker rm syslog-ng
syslog-ng
[root@localhost ~]# docker run -d -p 127.0.0.1:514:515/udp     -v /var/log/syslog-ng:/var/log/syslog-ng     --name syslog-ng bobrik/syslog-ng
6307a2a148b1323c5cddc2f4acb14b0e667e63fd3f98e85bd6a35bad358a551d
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                      NAMES
6307a2a148b1        bobrik/syslog-ng    "/usr/sbin/syslog-ng "   22 seconds ago      Up 21 seconds       514/tcp, 514/udp, 127.0.0.1:514->515/udp   syslog-ng
ebbe54ce6794        my-haproxy-v15      "/docker-entrypoint.s"   9 minutes ago       Up 9 minutes        0.0.0.0:80->80/tcp                         mon-haproxy-v16
78f6bc54152e        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8083->80/tcp                       my-server4-4
fce6865343f1        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8082->80/tcp                       my-server4-3
a75937eb980d        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8081->80/tcp                       my-server4-2
eacf3e4bc897        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8080->80/tcp                       my-server4-1
2fc533c55725        postgres            "/docker-entrypoint.s"   16 hours ago        Up 16 hours         0.0.0.0:5432->5432/tcp                     postgres2
[root@localhost ~]# docker logs 6307a2a148b1
[root@localhost ~]# logger -n 127.0.0.1 -P 516 -p auth.notice "Mon message" -s -d

Je n’ai toujours rien dans le dossier /var/log/syslog-ng/. Même sans redirection de port je n’ai pas de logs :

[root@localhost ~]# docker run -d -v /var/log/syslog-ng:/var/log/syslog-ng     --name syslog-ng bobrik/syslog-ng
6b798602b6610a4046129ccae1338358da8ea27334dbab37fa8ca606f1fc0d4a
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
6b798602b661        bobrik/syslog-ng    "/usr/sbin/syslog-ng "   4 seconds ago       Up 3 seconds        514/tcp, 514/udp         syslog-ng
ebbe54ce6794        my-haproxy-v15      "/docker-entrypoint.s"   17 minutes ago      Up 17 minutes       0.0.0.0:80->80/tcp       mon-haproxy-v16
78f6bc54152e        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8083->80/tcp     my-server4-4
fce6865343f1        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8082->80/tcp     my-server4-3
a75937eb980d        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8081->80/tcp     my-server4-2
eacf3e4bc897        my-server4          "/sbin/server4"          6 hours ago         Up 6 hours          0.0.0.0:8080->80/tcp     my-server4-1
2fc533c55725        postgres            "/docker-entrypoint.s"   16 hours ago        Up 16 hours         0.0.0.0:5432->5432/tcp   postgres2
[root@localhost ~]# docker exec -t syslog-ng tail -f /var/log/syslog-ng/*
tail: can't open '/var/log/syslog-ng/*': No such file or directory
tail: no files

Je pense que cela ne va pas être trivial. J’ai pu lire un article « 6 million ways to log in docker« . J’ai du en tester 10 sans succès … La communauté Docker c’est la modestie avant tout 😉 .

Je vais essayer avec rsyslog.

[root@localhost ~]# docker run -d -v /tmp:/var/log/syslog -p 127.0.0.1:5514:514/udp  --name rsyslog voxxit/rsyslog
Unable to find image 'voxxit/rsyslog:latest' locally
latest: Pulling from voxxit/rsyslog
6d6a6a7dae29: Pull complete 
117d78ae6306: Pull complete 
de74d1b16221: Pull complete 
8c510761e859: Pull complete 
Digest: sha256:2a874ed2f56e5854714ce68ef905f5e1c428aed92cf92e19e8c925d5faf4f277
Status: Downloaded newer image for voxxit/rsyslog:latest
44f6508471599f22cbbaae8464d9925878300198c32aca388a4eaf27bb89c655

Dans un premier temps je vais essayer d’envoyer vers le syslog local.

[root@localhost ~]# docker run -d --link my-server4-1 --link my-server4-2 --link my-server4-3 --link my-server4-4 --log-driver=syslog --log-opt syslog-address=udp://127.0.0.1:514 --log-opt syslog-facility=daemon --log-opt syslog-tag=mon-haproxy -p 80:80 --name mon-haproxy-v16 my-haproxy-v15 
3aa83e6ee91344caafa858d637810a01546dd9aee330383c0d66379ecdfc0126
[root@localhost ~]# docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
3aa83e6ee913        my-haproxy-v15      "/docker-entrypoint.s"   5 seconds ago       Up 4 seconds        0.0.0.0:80->80/tcp       mon-haproxy-v16
78f6bc54152e        my-server4          "/sbin/server4"          7 hours ago         Up 7 hours          0.0.0.0:8083->80/tcp     my-server4-4
fce6865343f1        my-server4          "/sbin/server4"          7 hours ago         Up 7 hours          0.0.0.0:8082->80/tcp     my-server4-3
a75937eb980d        my-server4          "/sbin/server4"          7 hours ago         Up 7 hours          0.0.0.0:8081->80/tcp     my-server4-2
eacf3e4bc897        my-server4          "/sbin/server4"          7 hours ago         Up 7 hours          0.0.0.0:8080->80/tcp     my-server4-1
2fc533c55725        postgres            "/docker-entrypoint.s"   17 hours ago        Up 17 hours         0.0.0.0:5432->5432/tcp   postgres2
[root@localhost ~]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

HELLO
IP

eth0
QUIT
Connection closed by foreign host.
[root@localhost ~]# tail -f /var/log/messages 
Apr 15 14:17:01 localhost NetworkManager[554]:   (docker0): bridge port vethd376d33 was attached
Apr 15 14:17:01 localhost NetworkManager[554]:   (vethd376d33): enslaved to docker0
Apr 15 14:17:01 localhost kernel: eth0: renamed from vethd8906f7
Apr 15 14:17:01 localhost kernel: IPv6: ADDRCONF(NETDEV_CHANGE): vethd376d33: link becomes ready
Apr 15 14:17:01 localhost kernel: docker0: port 6(vethd376d33) entered forwarding state
Apr 15 14:17:01 localhost kernel: docker0: port 6(vethd376d33) entered forwarding state
Apr 15 14:17:01 localhost NetworkManager[554]:   (vethd8906f7): failed to disable userspace IPv6LL address handling
Apr 15 14:17:01 localhost NetworkManager[554]:   (vethd376d33): link connected
Apr 15 14:17:01 localhost docker: time="2016-04-15T14:17:01.191761817+01:00" level=warning msg="Using log tag from deprecated log-opt 'syslog-tag'. Please use: --log-opt tag=\"mon-haproxy\""
Apr 15 14:17:16 localhost kernel: docker0: port 6(vethd376d33) entered forwarding state
[root@localhost ~]# docker stop mon-haproxy-v16
mon-haproxy-v16
[root@localhost ~]# docker rm mon-haproxy-v16
mon-haproxy-v16
[root@localhost ~]# docker run -d --link my-server4-1 --link my-server4-2 --link my-server4-3 --link my-server4-4 --log-driver=syslog --log-opt syslog-address=udp://127.0.0.1:514 --log-opt syslog-facility=daemon -p 80:80 --name mon-haproxy-v16 my-haproxy-v15 
123df78c2db1ec010b9348049ae58519cf5f656a6a433c27e8a6b966bd57ed67
[root@localhost ~]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

HELLO
QUIT
Connection closed by foreign host.
[root@localhost ~]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

HELLO
QUIT
Connection closed by foreign host.
[root@localhost ~]# tail -f /var/log/messages 
Apr 15 14:19:44 localhost NetworkManager[554]:   (veth36cbbad): new Veth device (carrier: OFF, driver: 'veth', ifindex: 337)
Apr 15 14:19:44 localhost NetworkManager[554]:   (docker0): bridge port veth36cbbad was attached
Apr 15 14:19:44 localhost NetworkManager[554]:   (veth36cbbad): enslaved to docker0
Apr 15 14:19:44 localhost kernel: eth0: renamed from veth5611685
Apr 15 14:19:44 localhost NetworkManager[554]:   (veth5611685): failed to disable userspace IPv6LL address handling
Apr 15 14:19:44 localhost NetworkManager[554]:   (veth36cbbad): link connected
Apr 15 14:19:44 localhost kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth36cbbad: link becomes ready
Apr 15 14:19:44 localhost kernel: docker0: port 6(veth36cbbad) entered forwarding state
Apr 15 14:19:44 localhost kernel: docker0: port 6(veth36cbbad) entered forwarding state
Apr 15 14:19:59 localhost kernel: docker0: port 6(veth36cbbad) entered forwarding state

Aie j’ai oublié de refaire le build …

[root@localhost ~]# cat haproxy.cfg 
global
    maxconn 400

defaults
    log 127.0.0.1 local0
    mode    tcp
    option  tcplog
    option  dontlognull
    retries 4
    maxconn 200
    timeout connect  5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80	
    log 127.0.0.1 local0	
    default_backend serveur

backend serveur
        mode tcp
        balance roundrobin
        server server1 my-server4-1:80
        server server2 my-server4-2:80
        server server3 my-server4-3:80
        server server4 my-server4-4:80

[root@localhost ~]# docker build -t my-haproxy-v15 .
Sending build context to Docker daemon 132.1 kB
Step 1 : FROM haproxy:1.5
 ---> 011e001101c0
Step 2 : COPY ./haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
 ---> 3579ba8e9e3c
Removing intermediate container 37aab30df069
Step 3 : EXPOSE 80
 ---> Running in 2e94185ce8bd
 ---> 824e19a4591a
Removing intermediate container 2e94185ce8bd
Successfully built 824e19a4591a

J’ai aussi essayé :

[root@localhost ~]# cat haproxy.cfg 
global
    maxconn 400

defaults
    log 127.0.0.1 local0
    log 127.0.0.1 local1 notice
    mode    tcp
    option  tcplog
    option  dontlognull
    retries 4
    maxconn 200
    timeout connect  5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80
    default_backend serveur

backend serveur
        mode tcp
        balance roundrobin
        server server1 my-server4-1:80
        server server2 my-server4-2:80
        server server3 my-server4-3:80
        server server4 my-server4-4:80

Et dernièrement :

[root@localhost ~]# cat haproxy.cfg 
global
    maxconn 400

defaults
    log 127.0.0.1 local0
    log 127.0.0.1 local1 notice
    log 127.0.0.1 local5 debug
    mode    tcp
    option  tcplog
    option  dontlognull
    retries 4
    maxconn 200
    timeout connect  5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80
    default_backend serveur

backend serveur
        mode tcp
        balance roundrobin
        server server1 my-server4-1:80
        server server2 my-server4-2:80
        server server3 my-server4-3:80
        server server4 my-server4-4:80

Sans succès… mais je me suis rendu compte que rsyslog n’écoutais pas en local, j’ai donc modifié la configuration dans : /etc/rsyslog.conf.

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
# Ajout
local1.*                                                /var/log/docker-1.log
local5.*                                                /var/log/docker-5.log
[root@localhost ~]# systemctl restart rsyslog.service
[root@localhost ~]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

HELLO
QUIT
Connection closed by foreign host.
[root@localhost ~]# tail -f /var/log/
anaconda/           btmp                dmesg.old           lastlog             ppp/                syslog-ng/          wpa_supplicant.log  
audit/              cron                firewalld           maillog             secure              tallylog            wtmp                
boot.log            dmesg               grubby              messages            spooler             tuned/              yum.log             
[root@localhost ~]# tail -f /var/log/messages 
Apr 15 14:44:13 localhost rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="17977" x-info="http://www.rsyslog.com"] exiting on signal 15.
Apr 15 14:44:13 localhost rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="17996" x-info="http://www.rsyslog.com"] start
Apr 15 14:44:13 localhost systemd: Stopping System Logging Service...
Apr 15 14:44:13 localhost systemd: Starting System Logging Service...
Apr 15 14:44:13 localhost systemd: Started System Logging Service.

Mon dernier test :

[root@localhost ~]# cat haproxy.cfg 
global
    maxconn 400

defaults
    log 127.0.0.1 local5 debug
    mode    tcp
    retries 4
    maxconn 200
    timeout connect  5000
    timeout client  50000
    timeout server  50000

frontend http-in
    bind *:80
    default_backend serveur

backend serveur
        mode tcp
        balance roundrobin
        server server1 my-server4-1:80
        server server2 my-server4-2:80
        server server3 my-server4-3:80
        server server4 my-server4-4:80
...
[root@localhost ~]# docker run -d --link my-server4-1 --link my-server4-2 --link my-server4-3 --link my-server4-4 --log-driver=syslog --log-opt syslog-address=udp://127.0.0.1:514 --log-opt tag=haproxy -p 80:80 --name mon-haproxy-v16 my-haproxy-v15 
86bbca2ce9cdb141a286a96b79ecbd350abb171a2b35280d509ef19b82b11504

Misère.