Docker Docker Logging and Monitoring Logging Drivers jsonfile syslog journald gelf fluentd awslogs splunk none

1. Core Command / Concept

Logging drivers in Docker containers allow you to manage logs from within the container. docker run -d --log-driver.

2. Step-by-Step (numbered)

1. Check the default logging driver by running docker info.
2. List available logging drivers by running docker run --log-driver=json-file --help.
3. Run a container with the json-file logging driver by running docker run -d --log-driver=json-file --log-opt=max-size=10m --log-opt=labels=mylabel myimage.
4. Check the logs by running docker logs -f mycontainer.
5. ⚠️ Delete all stopped containers by running docker container prune.
6. Clean up by stopping and removing the container by running docker stop mycontainer && docker rm mycontainer.

3. Real Commands with Examples

Example 1: Syslog Logging Driver

• Purpose: Send logs to a syslog server.
• Command: docker run -d --log-driver=syslog --log-opt=syslog-address=tcp://localhost:514 myimage.
• Brief explanation of flags: --log-driver=syslog sets the logging driver to syslog, and --log-opt=syslog-address specifies the syslog server address.

Example 2: Journald Logging Driver

• Purpose: Send logs to the systemd journal.
• Command: docker run -d --log-driver=journald myimage.
• Brief explanation of flags: --log-driver=journald sets the logging driver to journald, which is the default on Linux systems.

Example 3: GELF Logging Driver

• Purpose: Send logs to a Graylog server.
• Command: docker run -d --log-driver=gelf --log-opt=gelf-address=tcp://localhost:12201 myimage.
• Brief explanation of flags: --log-driver=gelf sets the logging driver to gelf, and --log-opt=gelf-address specifies the Graylog server address.

4. Common Errors (3-5)

Error 1: Invalid logging driver

• Error message or symptom: Error response from daemon: Invalid log driver: "invalid-driver".
• Why it happens: The logging driver is not supported by Docker.
• One-line fix: docker run -d --log-driver=json-file myimage.

Error 2: Log file not found

• Error message or symptom: Error response from daemon: No such file or directory: '/var/log/mycontainer.log'.
• Why it happens: The log file specified by the logging driver does not exist.
• One-line fix: docker run -d --log-driver=json-file --log-opt=log-file=/var/log/mycontainer.log myimage.

Error 3: Log level not supported

• Error message or symptom: Error response from daemon: Invalid log level: "invalid-level".
• Why it happens: The log level specified by the logging driver is not supported.
• One-line fix: docker run -d --log-driver=json-file --log-opt=log-level=info myimage.

5. Quick Checks (3 scenarios)

Scenario 1: Check logging driver

• Situation: You want to check the logging driver used by a container.
• Command: docker inspect --format='{{.LogDriver}}' mycontainer.
• What a correct response looks like: json-file.

Scenario 2: Check log level

• Situation: You want to check the log level used by a container.
• Command: docker logs -f mycontainer.
• What a correct response looks like: INFO.

Scenario 3: Check log file

• Situation: You want to check the log file used by a container.
• Command: docker inspect --format='{{.LogConfig.LogFile}}' mycontainer.
• What a correct response looks like: /var/log/mycontainer.log.

6. Last-Minute Reference

• docker run --log-driver=json-file sets the logging driver to json-file.
• docker run --log-driver=syslog sets the logging driver to syslog.
• docker run --log-driver=journald sets the logging driver to journald.
• docker run --log-driver=gelf sets the logging driver to gelf.
• docker run --log-opt=log-level=info sets the log level to info.
• docker run --log-opt=log-file=/var/log/mycontainer.log sets the log file to /var/log/mycontainer.log.
• docker run --log-opt=syslog-address=tcp://localhost:514 sets the syslog server address to tcp://localhost:514.
• docker run --log-opt=gelf-address=tcp://localhost:12201 sets the Graylog server address to tcp://localhost:12201.
• docker run --log-opt=max-size=10m sets the maximum log file size to 10m.
• docker run --log-opt=labels=mylabel sets the log label to mylabel.
• ⚠️ docker container prune deletes all stopped containers.
• ⚠️ docker stop mycontainer && docker rm mycontainer stops and removes a container.