Docker container sshd logs

Install the rsyslog package in the docker container:

$ apt-get install rsyslog

then start the daemon:

$ service rsyslog start

It seems a message such as below can be ignored, sshd logs to /var/log/auth.log anyway.

 * Starting enhanced syslogd rsyslogd                                                                                                                                                                                                           
rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
rsyslogd: activation of module imklog failed [v8.32.0 try http://www.rsyslog.com/e/2145 ]

The auth log is managed by the Syslog service. This service itself is traditionally managed (started) by the init system (Upstart in your case). By default a container doesn't run an init system, meaning that you'd have to start rsyslog manually :

# rsyslogd

After that, you'll find your usual log files in /var/log.

NB: init systems are not fully compatible with Docker containers. A common practice is to use Supervisord to start multiple services/processes automatically.