OCIFBSD-LOGD(8) FreeBSD System Manager's Manual OCIFBSD-LOGD(8)

ocifbsd-logd — ocifbsd log aggregation and forwarding daemon

ocifbsd-logd [-f] [-c config_file] [-l log_level]

The ocifbsd-logd daemon aggregates, stores, forwards, and alerts on log entries produced by the ocifbsd(8) OCI runtime and the jails it manages. It keeps the most recent entries in a bounded in-memory ring buffer, rotates them to disk on a schedule, forwards copies to configured external endpoints, and evaluates alert rules that may invoke webhooks, send email, or run an administrator-defined command.

The options are:

Run in the foreground. The default is to daemonize via daemon(3).
config_file
Load config_file instead of the default /etc/ocifbsd/ocifbsd.conf. The configuration controls ring-buffer size, retention windows, forwarder destinations, and alert rules.
log_level
Set the minimum severity captured by the daemon. Valid levels are “emerg, alert, crit, err, warning, notice, info, debug”, and “trace”.

The daemon handles SIGTERM and SIGINT for graceful shutdown and SIGHUP to reload the configuration file.

  • An in-memory ring buffer (ringbuf.c) backs the query API and is the source of truth for recent entries.
  • A background rotation worker (rotation_worker) writes the current ring contents to timestamped files under /var/log/ocifbsd and applies the configured retention policy.
  • A forward worker (forward_worker) periodically delivers new entries to every enabled forwarder (syslog over UDP/TCP, fluentd, Elasticsearch, Splunk, or a custom HTTP webhook) using libcurl(3).
  • An alert worker (alert_worker) evaluates incoming entries against the alert rule tree and fires actions when a rule's count threshold is reached within its time window.
  • An event stream (event_publish, event_query) records lifecycle events for pods, containers, nodes, and cluster members and dispatches them to registered webhooks.

/etc/ocifbsd/ocifbsd.conf
Default configuration file.
/var/log/ocifbsd
Default storage path for rotated log files (“config.storage_path”).
/var/log/ocifbsd/ocifbsd.YYYYMMDD-HHMMSS.log
Rotated log file produced by log_rotate.

ocifbsd(8), daemon(3), curl(3), syslog(3)

The ocifbsd-logd command first appeared in FreeBSD 16.0.

The ocifbsd-logd utility was developed by Klara, Inc. under sponsorship from

FreeBSD 15.1-STABLE June 5, 2026 OCIFBSD-LOGD(8)