How to fix Error response from daemon: error while creating syslog logger: dial unix: connection refused in Docker

First, verify that a syslog daemon is running on your host system:

Check rsyslog (most common on Debian/Ubuntu):

sudo systemctl status rsyslog

Check syslog-ng (alternative daemon):

sudo systemctl status syslog-ng

If the service is not running, start it:

# For rsyslog
sudo systemctl start rsyslog
sudo systemctl enable rsyslog

# For syslog-ng
sudo systemctl start syslog-ng
sudo systemctl enable syslog-ng

Install rsyslog if not present:

# Debian/Ubuntu
sudo apt-get install rsyslog

# RHEL/CentOS/Fedora
sudo dnf install rsyslog

Check if the Unix socket file exists at the expected location:

ls -la /dev/log

You should see output like:

srw-rw-rw- 1 root root 0 Jan 1 12:00 /dev/log

The s at the beginning indicates it's a socket file.

If /dev/log doesn't exist:

1. The syslog service may not be running
2. The socket might be at a different location (check /var/run/syslog or /run/systemd/journal/syslog)
3. On some systems, journald provides the socket

Find where syslog is listening:

# Check rsyslog configuration
grep -r "imuxsock" /etc/rsyslog.conf /etc/rsyslog.d/

# Check what's listening on syslog sockets
sudo ss -xl | grep -E "(syslog|log)"

A common mistake is using unix:// instead of unixgram://. Syslog over Unix sockets uses datagram (UDP-like) protocol, not stream (TCP-like) protocol.

WRONG - stream socket:

docker run --log-driver=syslog \
  --log-opt syslog-address=unix:///dev/log \
  my-container

CORRECT - datagram socket:

docker run --log-driver=syslog \
  --log-opt syslog-address=unixgram:///dev/log \
  my-container

In docker-compose.yml:

services:
  my-service:
    image: my-image
    logging:
      driver: "syslog"
      options:
        syslog-address: "unixgram:///dev/log"
        tag: "{{.Name}}"

In daemon.json (for all containers):

{
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "unixgram:///dev/log"
  }
}

If the Unix socket approach continues to cause issues, consider using UDP or TCP to send logs to a syslog server:

UDP syslog (recommended for reliability):

docker run --log-driver=syslog \
  --log-opt syslog-address=udp://127.0.0.1:514 \
  my-container

TCP syslog:

docker run --log-driver=syslog \
  --log-opt syslog-address=tcp://127.0.0.1:514 \
  my-container

Configure rsyslog to listen on UDP/TCP:

Edit /etc/rsyslog.conf and uncomment these lines:

# For UDP
module(load="imudp")
input(type="imudp" port="514")

# For TCP
module(load="imtcp")
input(type="imtcp" port="514")

Then restart rsyslog:

sudo systemctl restart rsyslog

Note: UDP is generally preferred because if the syslog server is temporarily unavailable, the container can still start (logs are simply dropped). With TCP, Docker may block waiting for the connection.

If you're running your application in a container and want it to log to the host's syslog, you need to mount the socket:

docker run -v /dev/log:/dev/log my-container

In docker-compose.yml:

services:
  my-service:
    image: my-image
    volumes:
      - /dev/log:/dev/log

Important considerations:

- This mounts the host's syslog socket into the container
- The container's application can then use standard syslog calls
- This is different from using Docker's syslog logging driver
- Works well when your application uses syslog internally

For Docker's logging driver (not application syslog):

The logging driver connects from the Docker daemon (on the host), not from inside the container. So mounting /dev/log is only needed if your application uses syslog directly.

Security modules might prevent Docker from accessing the syslog socket:

Check SELinux status (RHEL/CentOS/Fedora):

getenforce

Temporarily disable SELinux to test:

sudo setenforce 0

If that fixes the issue, you can create a proper SELinux policy:

sudo ausearch -m avc -ts recent | audit2allow -M docker-syslog
sudo semodule -i docker-syslog.pp
sudo setenforce 1

Check AppArmor status (Ubuntu):

sudo aa-status

Check for AppArmor denials:

sudo dmesg | grep -i apparmor | grep -i denied

Temporarily disable Docker's AppArmor profile:

docker run --security-opt apparmor=unconfined --log-driver=syslog ...

Docker might start before the syslog service creates its socket. Ensure proper startup order:

Check systemd dependencies:

sudo systemctl show docker.service | grep -i after

Add dependency on syslog:

Create a systemd override file:

sudo mkdir -p /etc/systemd/system/docker.service.d
sudo cat << 'EOF' > /etc/systemd/system/docker.service.d/syslog.conf
[Unit]
After=rsyslog.service
Wants=rsyslog.service
EOF

Reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart docker

This ensures Docker waits for rsyslog to start before attempting to initialize.

Docker supports non-blocking log delivery, which prevents containers from failing to start when the logging backend is unavailable:

docker run --log-driver=syslog \
  --log-opt mode=non-blocking \
  --log-opt max-buffer-size=4m \
  --log-opt syslog-address=unixgram:///dev/log \
  my-container

In daemon.json:

{
  "log-driver": "syslog",
  "log-opts": {
    "mode": "non-blocking",
    "max-buffer-size": "4m",
    "syslog-address": "unixgram:///dev/log"
  }
}

How it works:

- Log messages are stored in an intermediate buffer
- If the syslog backend is down, messages queue up (up to max-buffer-size)
- When the buffer fills, oldest messages are dropped
- The container continues running regardless of syslog availability

Note: This won't fix the initial connection error - Docker still needs to connect at startup. But it helps with temporary syslog outages.

After making changes, test that the syslog logging driver works:

Test with a simple container:

docker run --rm --log-driver=syslog \
  --log-opt syslog-address=unixgram:///dev/log \
  --log-opt tag="docker-test" \
  alpine echo "Syslog test message"

Check that the message arrived in syslog:

sudo grep "docker-test" /var/log/syslog
# or
sudo journalctl -t docker-test

Test your actual container:

docker run --log-driver=syslog \
  --log-opt syslog-address=unixgram:///dev/log \
  your-image

If using daemon.json, restart Docker first:

sudo systemctl restart docker
docker info | grep "Logging Driver"

The output should show syslog as the logging driver.