# FluentD can't read logs

**URL:** <https://forums.suse.com/t/fluentd-cant-read-logs/18085>\
**Category:** SUSE Rancher Prime\
**Created:** [August 3, 2020, 9:45am UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085 "2020-08-03T09:45:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kareso](https://avatars.discourse-cdn.com/v4/letter/k/8e7dd6/32.png) [@kareso](https://forums.suse.com/u/kareso)\
**Post date:** [August 3, 2020, 9:45am UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085/1 "2020-08-03T09:45:35Z")

</div>

Hi. I’m trying to use built in FluentD app in Rancher to collect logs for Splunk. Nothink is comming to Splunk so far. I checked the logs in rancher-logging-fluentd-linux workloads and I can see messages [warn] /var/log/containers/\*\*\*\*.log unreadable. I found that logs in /var/logs/containers are just links to /opt/docker-data/containers. However I can’t access logs from fluentd pod. I guess I need to mount them. Can you advice me, how to do that?  
Tahnk you

---

<div class="post-metadata">

**Author:** ![Bill\_Gunter](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/bill_gunter/32/5966_2.png) [@Bill\_Gunter](https://forums.suse.com/u/Bill_Gunter)\
**Post date:** [August 7, 2020, 10:10pm UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085/2 "2020-08-07T22:10:33Z")

</div>

I had a similar problem and the root cause was that we had relocated the docker root from /var/lib. Fluentd can’t find the logs without some reconfiguration. Have you moved the docker root?

---

<div class="post-metadata">

**Author:** ![kareso](https://avatars.discourse-cdn.com/v4/letter/k/8e7dd6/32.png) [@kareso](https://forums.suse.com/u/kareso)\
**Post date:** [August 11, 2020, 1:45pm UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085/3 "2020-08-11T13:45:57Z")

</div>

It seem, that this is the root cause. According to result of docker info command:  
Docker Root Dir: /opt/docker-data

How do you suggest to fix it? Change docker root for cluster?

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://forums.suse.com/u/wajika)\
**Post date:** [August 20, 2020, 6:18am UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085/4 "2020-08-20T06:18:08Z")

</div>

Have you tested mount /opt/docker to solve the problem?

---

<div class="post-metadata">

**Author:** ![kareso](https://avatars.discourse-cdn.com/v4/letter/k/8e7dd6/32.png) [@kareso](https://forums.suse.com/u/kareso)\
**Post date:** [August 31, 2020, 7:15am UTC](https://forums.suse.com/t/fluentd-cant-read-logs/18085/5 "2020-08-31T07:15:27Z")

</div>

Hi. Sorry for late reply. I can´t do that on impacted cluster. I guess I need to set up my own FluentD image. Thanks for advice.