Switching logging from files to Docker logs

By default, most components in the Passwork Docker build write their logs to files. Below are examples of how to move the logs into Docker own handling (to stdout/stderr and the container log).

Environment variables

Starting with Passwork 7, Nginx and PHP-FPM in the containers do not run as root by default, so these services lack permission to write to stdout/stderr. To work around this restriction, you need to switch them back to running as root: in the root of the Docker build, create a docker-compose.override.yaml file or add the following to an existing one:

docker-compose.override.yaml

services:
  nginx:
    environment:
      - "NUSER=0"
  php-fpm:
    environment:
      - "PUSER=0"
  cron:
    environment:
      - "PUSER=0"

Nginx container

The Nginx configuration file is ./conf/nginx/nginx.conf.

• Change the error log directive: error_log /server/log/nginx/error.log; → error_log /dev/stdout;
• Change the access log directive: access_log /server/log/nginx/access.log; → access_log /dev/stdout;

PHP container

PHP-FPM configuration

The PHP-FPM configuration file is ./conf/php/php-fpm.conf.

Change the error log directive set — error_log = /proc/self/fd/2.

PHP-FPM pool configuration

The pool configuration file is ./conf/php/www.pool.

• Change the access event directive: access.log = /proc/self/fd/2

• Change the slow request event directive: slowlog = /proc/self/fd/2

Rsyslog service

The configuration file is ./conf/php/rsyslog.conf.

1. All events will be redirected to the Docker container log:
2. Events generated by PHP-FPM (effectively by Passwork) are sent to the SIEM; the rest go to the Docker container log. Replace SIEM_IP and PORT with the address and port of your SIEM system:

Without SIEM

module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
*.* -/proc/1/fd/2  # Send all messages to stdout
$IncludeConfig /etc/rsyslog.d/*.conf

With SIEM

module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then @SIEM_IP:PORT
if $programname != 'php-fpm' then -/proc/1/fd/2
$IncludeConfig /etc/rsyslog.d/*.conf

info

For more on configuring Syslog and forwarding Passwork events, see Configuring Syslog for Passwork events.

Postfix container

The configuration file is ./conf/postfix/postfix.conf.

Add the log writing directive: maillog_file = /dev/stdout.

PSMDB container

Events are redirected to the container log by default, no additional configuration is required.

Built-in Passwork scheduler logs

The built-in scheduler logs are rotated automatically by the automatic cleanup task in the background task settings:

LLM version