Syslog source failed to start with alloy

Grafana Alloy
1

Hi,

I configure my alloy to receive syslog messages like this:

logging {
	level  = "debug"
	format = "logfmt"
}

loki.source.syslog "syslog" {

  listener {
    address  = "0.0.0.0:1514"
    protocol = "udp"
    use_rfc5424_message = true
  }
  forward_to = [loki.write.grafana_loki.receiver]
}

loki.write "grafana_loki" {
    endpoint {
        url = "http://loki:3100/loki/api/v1/push"      
    }
}

I’m using docker for running Grafana Alloy like this:

  alloy:
    image: grafana/alloy:latest
    pull_policy: always
    profiles: [ "alloy" ]
    restart: on-failure
    volumes:
      - ./config/alloy:/etc/alloy
    command:
      - run
      - /etc/alloy/config.alloy
      - --storage.path=/var/lib/alloy/data
      - --server.http.listen-addr=0.0.0.0:12345
      - --stability.level=experimental # Enable all functionality
    ports:
      - "12345:12345"
      - "1514:1514/udp"
    depends_on:
      - syslog-ng

When I runned, the log show this message:

ts=2024-08-16T04:40:10.231800215Z level=warn msg="failed to read packets" component_path=/ component_id=loki.source.syslog.syslog addr=<nil> err="read udp [::]:1514: use of closed network connection"
ts=2024-08-16T04:40:10.231865966Z level=info msg="syslog server shutting down" component_path=/ component_id=loki.source.syslog.syslog protocol=udp err="context canceled"

At docker container, I not see port 1514 listen:

root@e9fdccabba7a:/# netstat -na
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.11:34685        0.0.0.0:*               LISTEN     
tcp        0      0 172.21.0.3:48548        172.21.0.2:3100         ESTABLISHED
tcp6       0      0 :::12345                :::*                    LISTEN     
udp        0      0 127.0.0.11:60361        0.0.0.0:*                          
udp6       0      0 :::1514                 :::*

How to solve this?

Tks

2

Try making your alloy container privileged and see if that helps.

3

Tks.

Now works…