Docker - Logging

Docker - Logging

Effective logging is crucial for monitoring applications and troubleshooting issues within containers. Docker provides mechanisms for logging at both the container level and the Docker daemon level.

Container Logging

By default, Docker captures the standard output (stdout) and standard error (stderr) streams of the main process running inside a container. These logs can be accessed using the docker logs command.

Using docker logs

First, ensure you have a container running (e.g., one started with docker run). Find its ID or name using docker ps.

# Example: Start a simple container that prints logs
docker run -d --name logger-test alpine sh -c 'while true; do echo "Log entry at $(date)"; sleep 5; done'

Now, view its logs:

# View all logs for the container 'logger-test'
docker logs logger-test

# Follow the logs in real-time (like tail -f)
docker logs -f logger-test

# Show only the last 5 log entries
docker logs --tail 5 logger-test

# Show logs since a specific timestamp
docker logs --since 2023-10-27T10:00:00 logger-test

# Add timestamps to each log line (provided by Docker)
docker logs -t logger-test

Logging Drivers

Docker uses logging drivers to determine where container logs are sent. The default driver is json-file, which stores logs as JSON files on the Docker host (usually under /var/lib/docker/containers/<container-id>/).

Other available drivers can send logs to different destinations:

• journald: Sends logs to the systemd journal (Linux).
• syslog: Sends logs to a syslog server.
• fluentd, gelf, awslogs, splunk, gcplogs: Send logs to respective centralized logging platforms.
• none: Disables logging for the container.

You can configure the default logging driver for all containers in the Docker daemon configuration (daemon.json) or specify a driver per container using the --log-driver and --log-opt flags with docker run.

# Example: Run a container using the 'syslog' driver
docker run -d --log-driver=syslog --name my-syslog-app my-image

Using appropriate logging drivers is essential for managing logs effectively in production, especially when dealing with many containers or requiring centralized log analysis.

Docker Daemon Logging

The Docker daemon itself also generates logs, which are useful for troubleshooting issues with the Docker Engine.

The location and method for accessing daemon logs depend on the host operating system and its init system:

• Linux (systemd): Use journalctl to view daemon logs: sudo journalctl -u docker.service. Add -f to follow logs.
• Docker Desktop (Windows/Mac): Logs can often be accessed through the Docker Desktop GUI (Troubleshoot section) or found in specific log files (check Docker Desktop documentation for locations).

Adjusting Daemon Log Level

You can change the verbosity of the daemon logs by setting the log-level option in the daemon.json configuration file (e.g., /etc/docker/daemon.json on Linux).

// Example /etc/docker/daemon.json excerpt
{
  "log-level": "debug"
}

Available levels typically include debug, info, warn, error, fatal. The default is usually info. Remember to restart the Docker daemon after modifying daemon.json (sudo systemctl restart docker). Use debug level only when actively troubleshooting, as it can generate a large volume of logs.