Centralized logging setup in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Docker logging driver output

You run a Docker container with the command:

docker run --log-driver=json-file --name test-container alpine echo hello

What will be the output of docker logs test-container?

A hello

B No output, because json-file driver does not store logs

C Error: logging driver not supported

D Container logs are empty

💡 Hint

The json-file logging driver stores container stdout and stderr logs locally.

The json-file driver stores logs in JSON format on the host. The command 'docker logs' reads these logs and shows the container output. Since the container runs 'echo hello', the logs will show 'hello'.

❓ Configuration

intermediate

Configure Docker to use syslog logging driver

Which Docker daemon configuration snippet correctly sets the default logging driver to syslog?

A

{
  "log_driver": "syslog"
}

B

{
  "logging-driver": "syslog"
}

C

{
  "log-driver": "syslog"
}

D

{
  "logdriver": "syslog"
}

💡 Hint

Docker daemon config uses kebab-case keys with hyphens.

The correct key to set the default logging driver in Docker daemon.json is 'log-driver'. Other keys are invalid and cause Docker to ignore the setting or error.

🔀 Workflow

advanced

Centralized logging with ELK stack and Docker

You want to send Docker container logs to an ELK (Elasticsearch, Logstash, Kibana) stack. Which logging driver should you configure on your containers to send logs directly to Logstash over TCP?

A json-file

B syslog

C fluentd

D gelf

💡 Hint

GELF is a logging format supported by Logstash for structured logs over TCP/UDP.

The GELF logging driver sends logs in Graylog Extended Log Format, which Logstash can receive over TCP or UDP. This allows direct integration with ELK stack.

❓ Troubleshoot

advanced

Docker logs missing after configuring syslog driver

After configuring Docker containers to use the syslog logging driver, you notice docker logs shows no output. Why does this happen?

A Syslog driver sends logs outside Docker, so 'docker logs' cannot access them

B Syslog driver disables container stdout and stderr

C Docker daemon crashed and lost logs

D The container did not produce any logs

💡 Hint

Syslog driver forwards logs to the host syslog service, not stored in Docker's local log files.

When using the syslog logging driver, logs are sent to the host's syslog service and are not stored in Docker's local log files. Therefore, 'docker logs' cannot retrieve them.

✅ Best Practice

expert

Best practice for centralized logging in a multi-host Docker swarm

In a Docker Swarm with multiple hosts, what is the best practice to collect and centralize logs from all containers across hosts?

A Configure each container to use the json-file driver and manually copy log files from each host

B Use a centralized logging agent like Fluentd or Logstash on each host to collect container logs and forward them to a central server

C Use the default Docker logging driver and rely on 'docker logs' command on each host separately

D Disable logging to improve performance and avoid log storage

💡 Hint

Centralized logging agents can collect logs from multiple sources and forward them reliably.

Using a logging agent like Fluentd or Logstash on each host allows collecting logs from all containers locally and forwarding them to a central logging server. This is scalable and manageable in multi-host environments.