--- title: "Install AxoSyslog with Podman and systemd" url: "https://axoflow.com/docs/axosyslog-core/4.28/install/podman-systemd/" last_modified: "2024-09-30T16:08:08+02:00" --- > For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt). # Install AxoSyslog with Podman and systemd This page shows you how to run AxoSyslog as a systemd service using podman. AxoSyslog provides [cloud-ready images](https://github.com/axoflow/axosyslog/). These images differ from the upstream `syslog-ng` images, because: - They’re based on Alpine Linux, instead of Debian testing for reliability and smaller size (thus smaller attack surface). - They incorporate cloud-native features and settings, such as the Kubernetes source. - They incorporate container-level optimizations for better performance and improved security. For example, they use an alternative malloc library. - They support the ARM architecture. The AxoSyslog images support the following architectures: - amd64 - arm/v7 - arm64 ## Prerequisites Podman version 4.6.1. The steps in this procedure were tested on CentOS 9, but should work on other similar distributions as well. ## Install AxoSyslog as a systemd service 1. Make sure that there is no `axosyslog.service` unit file on the system. Run the following commands: ```shell sudo rm /etc/systemd/system/axosyslog.service ``` Expected output: ```shell rm: cannot remove '/etc/systemd/system/axosyslog.service': No such file or directory ``` ```shell sudo systemctl cat axosyslog.service ``` Expected output: ```shell No files found for axosyslog.service. ``` 2. Create a systemd unit file called `/etc/containers/systemd/axosyslog.container` based on the following template: ```shell sudo curl -o /etc/containers/systemd/axosyslog.container https://axoflow.com/docs/axosyslog-core/install/podman-systemd/axosyslog.container ``` 3. Edit the unit file as needed for your environment. We recommend using the default mount points: | Purpose | On the host | In the container | | --- | --- | --- | | Disk-buffer and persist files | `/var/lib/syslog-ng` | `/var/lib/syslog-ng` | | `syslog-ng` configuration file | `/opt/axosyslog/etc` | `/etc/syslog-ng` | | Output log files | `/opt/axosyslog/var/log` | `/var/log` | 4. (Optional) Create an `override.conf` file to set custom environment values. This can be useful if you don’t want to modify `/etc/containers/systemd/axosyslog.container`. Run: ```shell systemctl edit axosyslog ``` Later you can edit this file by running the previous command again. 5. Create the `/opt/axosyslog/etc/syslog-ng.conf` configuration file based on the following template. ```shell sudo mkdir -p /opt/axosyslog/etc/ ; sudo curl -o /opt/axosyslog/etc/syslog-ng.conf https://axoflow.com/docs/axosyslog-core/install/podman-systemd/syslog-ng.conf ``` With the following sample configuration file AxoSyslog collects the local system logs and logs received from the network into the `/var/log/messages` file. You can customize the configuration file according to your needs. For a few pointers, see [Configuring AxoSyslog as a logserver](https://axoflow.com/docs/axosyslog-core/4.28/quickstart/configure-servers/index.md) and the rest of this guide. 6. Run the following commands to reload the systemd configuration and launch the `axosyslog` service. Though the systemctl commands are run as root, the container will run as the specified user if set appropriately in the unit file. ```shell sudo systemctl daemon-reload sudo systemctl stop axosyslog sudo systemctl start axosyslog ``` If there aren’t any errors, these commands don’t have any output. 7. Run the following command to verify that the service was properly started: ```shell journalctl -b -u axosyslog | tail -100 ``` The output should be similar to: ```shell Feb 12 09:04:40 systemd[1]: Starting AxoSyslog Container... Feb 12 09:04:40 podman[2783]: 2024-02-12 09:04:40.454665314 -0500 EST m=+0.167732500 system refresh Feb 12 09:04:40 axosyslog[2783]: Trying to pull ghcr.io/axoflow/axosyslog:latest... Feb 12 09:04:40 axosyslog[2783]: Pulling image //ghcr.io/axoflow/axosyslog:latest inside systemd: setting pull timeout to 5m0s Feb 12 09:04:41 axosyslog[2783]: Getting image source signatures Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:619be1103602d98e1963557998c954c892b3872986c27365e9f651f5bc27cab8 Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:b061f41886afb563aff2a5f731f3286ba54ea6f657ed3e282f5339a12a64c5ef Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:1b8d965a650c6a05227bd5c549930c9898071e8e7abb26886d4169a99762de0a Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:b5b0ce6ebef193c4f909379188cfb59443e8a1809816fbb476074908b170b4d1 Feb 12 09:04:50 axosyslog[2783]: Copying config sha256:c379d94ef2c5ec348dfb3a93eed9a19aed667c396008db85edc354c8f4f8cb6a Feb 12 09:04:50 axosyslog[2783]: Writing manifest to image destination Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.422390687 -0500 EST m=+10.135457863 container create 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.url=https://axoflow.io/, org.opencontainers.image.source=https://github.com/axoflow/axosyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.title=AxoSyslog, org.opencontainers.image.vendor=Axoflow, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, maintainer=axoflow.io, org.opencontainers.image.licenses=GPL-3.0-only) Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.402626446 -0500 EST m=+10.115693622 image pull c379d94ef2c5ec348dfb3a93eed9a19aed667c396008db85edc354c8f4f8cb6a ghcr.io/axoflow/axosyslog:latest Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.489925509 -0500 EST m=+10.202992695 container init 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.licenses=GPL-3.0-only, org.opencontainers.image.vendor=Axoflow, maintainer=axoflow.io, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.url=https://axoflow.io/, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.title=AxoSyslog, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, org.opencontainers.image.source=https://github.com/axoflow/axosyslog) Feb 12 09:04:50 systemd[1]: Started AxoSyslog Container. Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.500050669 -0500 EST m=+10.213117845 container start 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.source=https://github.com/axoflow/axosyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.licenses=GPL-3.0-only, org.opencontainers.image.vendor=Axoflow, org.opencontainers.image.title=AxoSyslog, maintainer=axoflow.io, org.opencontainers.image.url=https://axoflow.io/) Feb 12 09:04:50 axosyslog[2783]: 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f Feb 12 09:04:50 AxoSyslog[2821]: [2024-02-12T14:04:50.806054] syslog-ng starting up; version='4.6.0' ``` 8. Send a test message to the service (requires `nc` to be installed): ```shell echo '<5> localhost test: this is a test message' | nc localhost 514 ``` Check that the test message has arrived into the log file: ```shell cat /opt/axosyslog/var/log/messages ``` The output should be similar to: ```shell Feb 19 15:49:12 localhost test: this is a test message ``` ## Customize the configuration To customize the configuration, edit the `/opt/axosyslog/etc/syslog-ng.conf` file on the host, then reload the service. ## Managing the AxoSyslog systemd service - You can reload `syslog-ng` running in the container via systemctl. The following command reloads the `syslog-ng.conf` file, without stopping/starting `syslog-ng` itself. ```shell sudo systemctl reload axosyslog ``` - You can access `syslog-ng-ctl` from the host, for example by running: ```shell podman exec -ti AxoSyslog syslog-ng-ctl show-license-info ``` If you use `syslog-ng-ctl` regularly, you can create the `/opt/axosyslog/bin/syslog-ng-ctl` file with the following content, make it executable, and add it to your path. That way running `syslog-ng-ctl ` will execute the command in the AxoSyslog container. ```shell #!/bin/bash podman exec -ti AxoSyslog syslog-ng-ctl "$@" ``` - The traditional method of starting a service at boot (`systemctl enable`) is not supported for container services. To automatically start the AxoSyslog service, make sure that the following line is included in the unit file. (It is included in the sample template.) ```systemd [Install] WantedBy=default.target ``` Last modified September 30, 2024: [Podman install clarifications (dafda387)](https://github.com/axoflow/axosyslog-core-docs/commit/dafda3879da20128e884d34882e08a65879bb5ef)