Seb, Gregory -- do you think this could make z5? Seems like it would make the Support team's life simpler.

Yes, it's possible.

Now you have the following logs in a single stream:

cluster 2018-06-27 09:28:27.023631 mon.tarox mon.0 10.41.1.161:6789/0 2 : cluster [INF] mon.tarox is new leader, monstarox in quorum (ranks 0)
cluster 2018-06-27 09:28:27.031167 mon.tarox mon.0 10.41.1.161:6789/0 3 : cluster [DBG] monmap e1: 1 mons at {tarox=10.41.1.161:6789/0}
cluster 2018-06-27 09:28:27.056775 mon.tarox mon.0 10.41.1.161:6789/0 4 : cluster [DBG] fsmap
cluster 2018-06-27 09:28:27.093329 mon.tarox mon.0 10.41.1.161:6789/0 5 : cluster [DBG] osdmap e1: 0 total, 0 up, 0 in
cluster 2018-06-27 09:28:27.109418 mon.tarox mon.0 10.41.1.161:6789/0 6 : cluster [DBG] mgrmap e1: no daemons active
debug 2018-06-27 09:28:28.127 7fa9fc122700  1 mon.tarox@0(leader).log v3 unable to write to '/var/log/ceph/ceph.log' for channel 'cluster': (2) No such file or directory
debug 2018-06-27 09:32:34.213 7faa0012a700  0 mon.tarox@0(leader) e1 handle_command mon_command({"prefix": "status"} v 0) v1
debug 2018-06-27 09:32:34.214 7faa0012a700  0 log_channel(audit) log [DBG] : from='client.? 10.41.1.161:0/2460483619'entity='client.admin' cmd=[{"prefix": "status"}]: dispatch
audit 2018-06-27 09:32:34.214789 mon.tarox mon.0 10.41.1.161:6789/0 7 : audit [DBG] from='client.? 10.41.1.161:0/2460483619' entity='client.admin' cmd=[{"prefix": "status"}]: dispatch

This is what you will see from journalctl or docker logs

You have 'cluster', 'debug' and 'audit' logs.

Thank you, Seb.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2378