---
path: faq/docker/logging-stdout.mdx
title: Switching logging from files to Docker logs
slug: logging-stdout
description: >-
  Configuring the Passwork Docker build to move Nginx, PHP-FPM, Postfix and
  built-in scheduler logs to stdout/stderr and into the container log.
keywords:
  - Passwork
  - Docker
  - logs
  - stdout
  - Nginx
  - PHP-FPM
  - Postfix
  - rsyslog
  - SIEM
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

By default, most components in the Passwork Docker build write their logs to files. Below are examples of how to move the logs into Docker own handling (to `stdout`/`stderr` and the container log).

## Environment variables

Starting with Passwork 7, **Nginx** and **PHP-FPM** in the containers do not run as `root` by default, so these services lack permission to write to `stdout`/`stderr`. To work around this restriction, you need to switch them back to running as `root`: in the root of the Docker build, create a `docker-compose.override.yaml` file or add the following to an existing one:

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="yaml" label="docker-compose.override.yaml">

```yaml
services:
  nginx:
    environment:
      - "NUSER=0"
  php-fpm:
    environment:
      - "PUSER=0"
  cron:
    environment:
      - "PUSER=0"
```

  </TabItem>
</Tabs>

## Nginx container

The Nginx configuration file is `./conf/nginx/nginx.conf`.

- Change the error log directive: `error_log /server/log/nginx/error.log;` → `error_log /dev/stdout;`
- Change the access log directive: `access_log /server/log/nginx/access.log;` → `access_log /dev/stdout;`

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-nginx.png'}
  alt="Nginx log configuration in nginx.conf"
  format='regular'
/>

## PHP container

### PHP-FPM configuration

The PHP-FPM configuration file is `./conf/php/php-fpm.conf`.

Change the error log directive set — `error_log = /proc/self/fd/2`.

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-php-fpm.png'}
  alt="The error_log directive in php-fpm.conf"
  format='regular'
/>

### PHP-FPM pool configuration

The pool configuration file is `./conf/php/www.pool`.

- Change the access event directive: `access.log = /proc/self/fd/2`

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-php-pool-access.png'}
  alt="The access.log directive in www.pool"
  format='regular'
/>

- Change the slow request event directive: `slowlog = /proc/self/fd/2`

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-php-pool-slowlog.png'}
  alt="The slowlog directive in www.pool"
  format='regular'
/>

### Rsyslog service

The configuration file is `./conf/php/rsyslog.conf`.

1. All events will be redirected to the Docker container log:
2. Events generated by PHP-FPM (effectively by Passwork) are sent to the SIEM; the rest go to the Docker container log. Replace `SIEM_IP` and `PORT` with the address and port of your SIEM system:

<Tabs className="tabs-container">
  <TabItem className="tab-item-container" value="no-siem" label="Without SIEM">

```bash
module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
*.* -/proc/1/fd/2  # Send all messages to stdout
$IncludeConfig /etc/rsyslog.d/*.conf
```

  </TabItem>
  <TabItem className="tab-item-container" value="with-siem" label="With SIEM">

```bash
module(load="imuxsock") # provides support for local system logging
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileCreateMode 0644
$DirCreateMode 0755
:msg, contains, "DIGEST-MD5 common mech free" stop
if $programname == 'php-fpm' then @SIEM_IP:PORT
if $programname != 'php-fpm' then -/proc/1/fd/2
$IncludeConfig /etc/rsyslog.d/*.conf
```

  </TabItem>
</Tabs>

:::info
For more on configuring Syslog and forwarding Passwork events, see [Configuring Syslog for Passwork events](/faq/docker/syslog).
:::

## Postfix container

The configuration file is `./conf/postfix/postfix.conf`.

Add the log writing directive: `maillog_file = /dev/stdout`.

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-postfix.png'}
  alt="The maillog_file directive in postfix.conf"
  format='regular'
/>

## PSMDB container

Events are redirected to the container log by default, no additional configuration is required.

## Built-in Passwork scheduler logs

The built-in scheduler logs are rotated automatically by the automatic cleanup task in the background task settings:

<ImageComponent
  src={'/img/assets/faq-docker-logging-stdout-scheduler.png'}
  alt="Background task settings and scheduler log cleanup"
  format='regular'
/>