Edit

Docker and logs

Alt text

How docker logging works ?

It’s very simple, to log from a container, you have to write in stdout !

Where container logs are sent ? How can I see it ?

It’s a best practice to log on stdout from a container, it’s an unified interface and directly available from docker logs -f [container] or through docker-compose logs -f. Howerver docker save the output produced by containers in /var/lib/docker/containers/[CONTAINER ID]/[CONTAINER_ID]-json.log by default. Json file is the default log driver, the most easier.

Docker many built in log driver like as following :

  • none: No logs will be available for the container and docker logs will not return any output.
  • json-file: The logs are formatted as JSON. The default logging driver for Docker.
  • syslog: Writes logging messages to the syslog facility. The syslog daemon must be running on the host machine.
  • journald: Writes log messages to journald. The journald daemon must be running on the host machine.
  • gelf: Writes log messages to a Graylog Extended Log Format (GELF) endpoint such as Graylog or Logstash.
  • fluentd: Writes log messages to fluentd (forward input). The fluentd daemon must be running on the host machine.
  • awslogs: Writes log messages to Amazon CloudWatch Logs.
  • splunk: Writes log messages to splunk using the HTTP Event Collector.
  • etwlogs: Writes log messages as Event Tracing for Windows (ETW) events. Only available on Windows platforms.
  • gcplogs: Writes log messages to Google Cloud Platform (GCP) Logging.
  • nats: NATS logging driver for Docker. Publishes log entries to a NATS server.

docker logs command is only available with json-file and journald, than mean you need to bring your infrastructure to visualize your logs!

With json-file driver you will out of disk space, mostly if you work with worker (or application) which produce a huge amount of logs. You specify some parameters in order to avoid that.

  • max-size The maximum size of the log before it is rolled. A positive integer plus a modifier representing the unit of measure (k, m, or g).
--log-opt max-size=0m
  • max-file The maximum number of log files that can be present. If rolling the logs creates excess files, the oldest file is removed. Only effective when max-size is also set. A positive integer.
--log-opt max-file=3
  • labels Applies when starting the Docker daemon. A comma-separated list of logging-related labels this daemon will accept. Used for advanced log tag options.
--log-opt labels=production_status,geo
  • env Applies when starting the Docker daemon. A comma-separated list of logging-related environment variables this daemon will accept. Used for advanced log tag options.
--log-opt env=os,customer

If you want to learn more about docker logging driver and configuration, you can checkout this page https://docs.docker.com/engine/admin/logging/overview/

Logrotate

If you prefer that your host manage logs via logrotate rather than via container definition.

vim /etc/logrotate.d/docker

/var/lib/docker/containers/*/*.log {

  rotate 7

  daily

  compress

  size=1M

  missingok

  delaycompress

  copytruncate

}

And then

logrotate -fv /etc/logrotate.d/docker
%23%20Docker%20and%20logs%0A%0A@%28Postach.io%29%5Bdocker%2C%20tips%2C%20logs%2C%20published%5D%0A%0A%21%5BAlt%20text%5D%28./docker-tribe.png%29%0A%0A%23%23%20How%20docker%20logging%20works%20%3F%0A%0AIt%27s%20very%20simple%2C%20to%20log%20from%20a%20container%2C%20you%20have%20to%20write%20in%20%60stdout%60%20%21%0A%0A%23%23%20Where%20container%20logs%20are%20sent%20%3F%20How%20can%20I%20see%20it%20%3F%0A%0AIt%27s%20a%20best%20practice%20to%20log%20on%20%60stdout%60%20from%20a%20container%2C%20it%27s%20an%20unified%20interface%20and%20directly%20available%20from%20%60docker%20logs%20-f%20%5Bcontainer%5D%60%20or%20through%20%60docker-compose%20logs%20-f%60.%20Howerver%20docker%20save%20the%20output%20produced%20by%20containers%20in%20%60/var/lib/docker/containers/%5BCONTAINER%20ID%5D/%5BCONTAINER_ID%5D-json.log%60%20by%20default.%20Json%20file%20is%20the%20default%20log%20driver%2C%20the%20most%20easier.%0A%0ADocker%20many%20built%20in%20log%20driver%20like%20as%20following%20%3A%20%0A%0A*%20**none%3A**%09No%20logs%20will%20be%20available%20for%20the%20container%20and%20docker%20logs%20will%20not%20return%20any%20output.%09%20%0A*%20**json-file%3A**%09The%20logs%20are%20formatted%20as%20JSON.%20The%20default%20logging%20driver%20for%20Docker.%09%20%0A*%20**syslog%3A**%09Writes%20logging%20messages%20to%20the%20syslog%20facility.%20The%20syslog%20daemon%20must%20be%20running%20on%20the%20host%20machine.%09%20%0A*%20**journald%3A**%09Writes%20log%20messages%20to%20journald.%20The%20journald%20daemon%20must%20be%20running%20on%20the%20host%20machine.%09%20%0A*%20**gelf%3A**%09Writes%20log%20messages%20to%20a%20Graylog%20Extended%20Log%20Format%20%28GELF%29%20endpoint%20such%20as%20Graylog%20or%20Logstash.%09%20%0A*%20**fluentd%3A**%09Writes%20log%20messages%20to%20fluentd%20%28forward%20input%29.%20The%20fluentd%20daemon%20must%20be%20running%20on%20the%20host%20machine.%09%20%0A*%20**awslogs%3A**%09Writes%20log%20messages%20to%20Amazon%20CloudWatch%20Logs.%09%20%0A*%20**splunk%3A**%09Writes%20log%20messages%20to%20splunk%20using%20the%20HTTP%20Event%20Collector.%09%20%0A*%20**etwlogs%3A**%09Writes%20log%20messages%20as%20Event%20Tracing%20for%20Windows%20%28ETW%29%20events.%20Only%20available%20on%20Windows%20platforms.%09%20%0A*%20**gcplogs%3A**%09Writes%20log%20messages%20to%20Google%20Cloud%20Platform%20%28GCP%29%20Logging.%09%20%0A*%20**nats%3A**%09NATS%20logging%20driver%20for%20Docker.%20Publishes%20log%20entries%20to%20a%20NATS%20server.%0A%0A%0A%60docker%20logs%60%20command%20is%20only%20available%20with%20%60json-file%60%20and%20%60journald%60%2C%20than%20mean%20you%20need%20to%20bring%20your%20infrastructure%20to%20visualize%20your%20logs%21%0A%0AWith%20%60json-file%60%20driver%20you%20will%20out%20of%20disk%20space%2C%20mostly%20if%20you%20work%20with%20worker%20%28or%20application%29%20which%20produce%20a%20huge%20amount%20of%20logs.%20You%20specify%20some%20parameters%20in%20order%20to%20avoid%20that.%20%0A%0A*%20**max-size**%20The%20maximum%20size%20of%20the%20log%20before%20it%20is%20rolled.%20A%20positive%20integer%20plus%20a%20modifier%20representing%20the%20unit%20of%20measure%20%28k%2C%20m%2C%20or%20g%29.%0A%0A%60%60%60%0A--log-opt%20max-size%3D10m%0A%60%60%60%0A*%20**max-file**%20The%20maximum%20number%20of%20log%20files%20that%20can%20be%20present.%20If%20rolling%20the%20logs%20creates%20excess%20files%2C%20the%20oldest%20file%20is%20removed.%20**Only%20effective**%20when%20max-size%20**is%20also%20set**.%20A%20positive%20integer.%0A%0A%60%60%60%0A--log-opt%20max-file%3D3%0A%60%60%60%0A%0A*%20**labels**%20Applies%20when%20starting%20the%20Docker%20daemon.%20A%20comma-separated%20list%20of%20logging-related%20labels%20this%20daemon%20will%20accept.%20Used%20for%20advanced%20log%20tag%20options.%0A%0A%60%60%60%0A--log-opt%20labels%3Dproduction_status%2Cgeo%0A%60%60%60%0A%0A*%20**env**%20Applies%20when%20starting%20the%20Docker%20daemon.%20A%20comma-separated%20list%20of%20logging-related%20environment%20variables%20this%20daemon%20will%20accept.%20Used%20for%20advanced%20log%20tag%20options.%0A%0A%60%60%60%0A--log-opt%20env%3Dos%2Ccustomer%0A%60%60%60%0A%20%20%20%0A%3E%20%20If%20you%20want%20to%20learn%20more%20about%20docker%20logging%20driver%20and%20configuration%2C%20you%20can%20checkout%20this%20page%20https%3A//docs.docker.com/engine/admin/logging/overview/%0A%0A%23%23%20Logrotate%0A%0AIf%20you%20prefer%20that%20your%20host%20manage%20logs%20via%20logrotate%20rather%20than%20via%20container%20definition.%0A%0A%60%60%60cmd%0Avim%20/etc/logrotate.d/docker%0A%60%60%60%0A%0A%60%60%60%0A/var/lib/docker/containers/*/*.log%20%7B%0A%20%20rotate%207%0A%20%20daily%0A%20%20compress%0A%20%20size%3D1M%0A%20%20missingok%0A%20%20delaycompress%0A%20%20copytruncate%0A%7D%0A%60%60%60%0A%0AAnd%20then%0A%0A%60%60%60%0Alogrotate%20-fv%20/etc/logrotate.d/docker%0A%60%60%60