# Install AxoSyslog with Podman and systemd
This page shows you how to run AxoSyslog as a systemd service using podman.
AxoSyslog provides [cloud-ready images](). These images differ from the upstream `syslog-ng` images, because:
* They’re based on Alpine Linux, instead of Debian testing for reliability and smaller size (thus smaller attack surface).
* They incorporate cloud-native features and settings, such as the Kubernetes source.
* They incorporate container-level optimizations for better performance and improved security. For example, they use an alternative malloc library.
* They support the ARM architecture.
The AxoSyslog images support the following architectures:
* amd64
* arm/v7
* arm64
## Prerequisites
Podman version 4.6.1.
The steps in this procedure were tested on CentOS 9, but should work on other similar distributions as well.
## Install AxoSyslog as a systemd service
1. Make sure that there is no `axosyslog.service` unit file on the system. Run the following commands:
```
sudo rm /etc/systemd/system/axosyslog.service
```
Expected output:
```
rm: cannot remove '/etc/systemd/system/axosyslog.service': No such file or directory
```
```
sudo systemctl cat axosyslog.service
```
Expected output:
```
No files found for axosyslog.service.
```
2. Create a systemd unit file called `/etc/containers/systemd/axosyslog.container` based on the following template:
```
sudo curl -o /etc/containers/systemd/axosyslog.container https://axoflow.com/docs/axosyslog-core/install/podman-systemd/axosyslog.container
```
```
```
3. Edit the unit file as needed for your environment.
We recommend using the default mount points:
Purpose | On the host | In the container
---|---|---
Disk-buffer and persist files | `/var/lib/syslog-ng` | `/var/lib/syslog-ng`
`syslog-ng` configuration file | `/opt/axosyslog/etc` | `/etc/syslog-ng`
Output log files | `/opt/axosyslog/var/log` | `/var/log`
4. (Optional) Create an `override.conf` file to set custom environment values. This can be useful if you don’t want to modify `/etc/containers/systemd/axosyslog.container`. Run:
```
systemctl edit axosyslog
```
Later you can edit this file by running the previous command again.
5. Create the `/opt/axosyslog/etc/syslog-ng.conf` configuration file based on the following template.
```
sudo mkdir -p /opt/axosyslog/etc/ ; sudo curl -o /opt/axosyslog/etc/syslog-ng.conf https://axoflow.com/docs/axosyslog-core/install/podman-systemd/syslog-ng.conf
```
With the following sample configuration file AxoSyslog collects the local system logs and logs received from the network into the `/var/log/messages` file.
```
```
You can customize the configuration file according to your needs. For a few pointers, see [Configuring AxoSyslog on server hosts](../../docs/axosyslog-core/quickstart/configure-servers/index.md) and the rest of this guide.
6. Run the following commands to reload the systemd configuration and launch the `axosyslog` service. Though the systemctl commands are run as root, the container will run as the specified user if set appropriately in the unit file.
```
sudo systemctl daemon-reload
sudo systemctl stop axosyslog
sudo systemctl start axosyslog
```
If there aren’t any errors, these commands don’t have any output.
7. Run the following command to verify that the service was properly started:
```
journalctl -b -u axosyslog | tail -100
```
The output should be similar to:
```
Feb 12 09:04:40 systemd[1]: Starting AxoSyslog Container...
Feb 12 09:04:40 podman[2783]: 2024-02-12 09:04:40.454665314 -0500 EST m=+0.167732500 system refresh
Feb 12 09:04:40 axosyslog[2783]: Trying to pull ghcr.io/axoflow/axosyslog:latest...
Feb 12 09:04:40 axosyslog[2783]: Pulling image //ghcr.io/axoflow/axosyslog:latest inside systemd: setting pull timeout to 5m0s
Feb 12 09:04:41 axosyslog[2783]: Getting image source signatures
Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:619be1103602d98e1963557998c954c892b3872986c27365e9f651f5bc27cab8
Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:b061f41886afb563aff2a5f731f3286ba54ea6f657ed3e282f5339a12a64c5ef
Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:1b8d965a650c6a05227bd5c549930c9898071e8e7abb26886d4169a99762de0a
Feb 12 09:04:41 axosyslog[2783]: Copying blob sha256:b5b0ce6ebef193c4f909379188cfb59443e8a1809816fbb476074908b170b4d1
Feb 12 09:04:50 axosyslog[2783]: Copying config sha256:c379d94ef2c5ec348dfb3a93eed9a19aed667c396008db85edc354c8f4f8cb6a
Feb 12 09:04:50 axosyslog[2783]: Writing manifest to image destination
Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.422390687 -0500 EST m=+10.135457863 container create 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.url=https://axoflow.io/, org.opencontainers.image.source=https://github.com/axoflow/axosyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.title=AxoSyslog, org.opencontainers.image.vendor=Axoflow, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, maintainer=axoflow.io, org.opencontainers.image.licenses=GPL-3.0-only)
Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.402626446 -0500 EST m=+10.115693622 image pull c379d94ef2c5ec348dfb3a93eed9a19aed667c396008db85edc354c8f4f8cb6a ghcr.io/axoflow/axosyslog:latest
Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.489925509 -0500 EST m=+10.202992695 container init 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.licenses=GPL-3.0-only, org.opencontainers.image.vendor=Axoflow, maintainer=axoflow.io, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.url=https://axoflow.io/, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.title=AxoSyslog, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, org.opencontainers.image.source=https://github.com/axoflow/axosyslog)
Feb 12 09:04:50 systemd[1]: Started AxoSyslog Container.
Feb 12 09:04:50 podman[2783]: 2024-02-12 09:04:50.500050669 -0500 EST m=+10.213117845 container start 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f (image=ghcr.io/axoflow/axosyslog:latest, name=AxoSyslog, PODMAN_SYSTEMD_UNIT=axosyslog.service, org.opencontainers.image.source=https://github.com/axoflow/axosyslog, org.opencontainers.image.authors=Axoflow, org.opencontainers.image.description=A cloud-native distribution of syslog-ng by Axoflow, org.opencontainers.image.documentation=https://axoflow.com/docs/axosyslog/docs/, org.opencontainers.image.licenses=GPL-3.0-only, org.opencontainers.image.vendor=Axoflow, org.opencontainers.image.title=AxoSyslog, maintainer=axoflow.io, org.opencontainers.image.url=https://axoflow.io/)
Feb 12 09:04:50 axosyslog[2783]: 477c9f011684f767aae138a0f88602ff30a8c95a46d616bb3b95318ec3a4b79f
Feb 12 09:04:50 AxoSyslog[2821]: [2024-02-12T14:04:50.806054] syslog-ng starting up; version='4.6.0'
```
8. Send a test message to the service (requires `nc` to be installed):
```
echo '<5> localhost test: this is a test message' | nc localhost 514
```
Check that the test message has arrived into the log file:
```
cat /opt/axosyslog/var/log/messages
```
The output should be similar to:
```
Feb 19 15:49:12 localhost test: this is a test message
```
## Customize the configuration
To customize the configuration, edit the `/opt/axosyslog/etc/syslog-ng.conf` file on the host, then reload the service.
## Managing the AxoSyslog systemd service
* You can reload `syslog-ng` running in the container via systemctl. The following command reloads the `syslog-ng.conf` file, without stopping/starting `syslog-ng` itself.
```
sudo systemctl reload axosyslog
```
* You can access `syslog-ng-ctl` from the host, for example by running:
```
podman exec -ti AxoSyslog syslog-ng-ctl show-license-info
```
If you use `syslog-ng-ctl` regularly, you can create the `/opt/axosyslog/bin/syslog-ng-ctl` file with the following content, make it executable, and add it to your path. That way running `syslog-ng-ctl ` will execute the command in the AxoSyslog container.
```
#!/bin/bash
podman exec -ti AxoSyslog syslog-ng-ctl "$@"
```
* The traditional method of starting a service at boot (`systemctl enable`) is not supported for container services. To automatically start the AxoSyslog service, make sure that the following line is included in the unit file. (It is included in the sample template.)
```
[Install]
WantedBy=default.target
```
Last modified September 30, 2024: [Podman install clarifications (dafda387)]()