Docker logging drivers - Commands & Configuration

Introduction

When you run applications inside Docker containers, you need to see what they print out to understand what is happening. Docker logging drivers control how and where these logs are saved or sent, so you can check them later or send them to other tools.

When you want to save container logs to a file on the host machine for later review.

When you want to send container logs to a centralized system like syslog or journald for easier monitoring.

When you want to limit the size of log files to avoid filling up your disk space.

When you want to use a special logging service like Fluentd or GELF to collect logs from many containers.

When you want to disable logging to save resources if logs are not needed.

Commands

This command runs an nginx container named 'my-app' using the default 'json-file' logging driver. It limits each log file to 10 megabytes and keeps up to 3 log files to save disk space.

Terminal

docker run --log-driver json-file --log-opt max-size=10m --log-opt max-file=3 --name my-app nginx

Expected Output

Unable to find image 'nginx:latest' locally

latest: Pulling from library/nginx

Digest: sha256:...

Status: Downloaded newer image for nginx:latest

f1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d1e2f

→

--log-driver - Selects the logging driver to use for the container.

→

--log-opt - Sets options for the logging driver, like max file size and number of files.

Shows the logs produced by the 'my-app' container so you can see what the application printed.

Terminal

docker logs my-app

Expected Output

127.0.0.1 - - [date] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0"

Runs an nginx container named 'no-logs' with logging disabled to save resources when logs are not needed.

Terminal

docker run --log-driver none --name no-logs nginx

Expected Output

Unable to find image 'nginx:latest' locally

latest: Pulling from library/nginx

Digest: sha256:...

Status: Downloaded newer image for nginx:latest

abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890

→

--log-driver - Disables logging by setting the driver to 'none'.

Checks which logging driver is used by the 'my-app' container to confirm the logging setup.

Terminal

docker inspect --format='{{.HostConfig.LogConfig.Type}}' my-app

Expected Output

json-file

Key Concept

If you remember nothing else from Docker logging drivers, remember: they control where and how your container logs are saved or sent, helping you monitor and manage your apps.

Common Mistakes

Not specifying a logging driver and expecting logs to be sent to a central system.

Docker uses the default 'json-file' driver which saves logs locally, so logs won't appear in external systems.

Specify the correct logging driver like 'syslog' or 'fluentd' with --log-driver and configure options accordingly.

Setting log file size limits too high or not at all, causing disk space to fill up.

Without limits, logs can grow indefinitely and fill the disk, causing system problems.

Use --log-opt max-size and max-file to limit log file size and number of files.

Disabling logging with --log-driver none but still expecting to see logs with docker logs.

With logging disabled, docker logs shows nothing because no logs are saved.

Only disable logging if you do not need logs; otherwise use a proper logging driver.

Summary

Use --log-driver to choose how Docker saves or sends container logs.

Use --log-opt to set options like max file size and number of log files.

Check logs with docker logs and verify logging driver with docker inspect.

Practice

1. What is the default Docker logging driver used if none is specified?

easy

A. none

B. syslog

C. journald

D. json-file

Solution

1. Step 1: Understand Docker default logging behavior

   Docker uses a default logging driver to store container logs unless changed.

2. Step 2: Identify the default driver

   The default driver is json-file, which stores logs as JSON files on the host.

3. Final Answer:

   json-file -> Option D

4. Quick Check:

   Default logging driver = json-file [OK]

Hint: Default is json-file unless changed in daemon config [OK]

Common Mistakes:

• Choosing syslog as default
• Thinking none disables logging by default
• Confusing journald with default

2. Which of the following is the correct syntax to set the logging driver to syslog when running a container?

easy

A. docker run --log-driver=syslog myimage

B. docker run --logging=syslog myimage

C. docker run --logdriver=syslog myimage

D. docker run --log syslog myimage

Solution

1. Step 1: Recall Docker run command options for logging

   The correct flag to specify logging driver is --log-driver.

2. Step 2: Match the correct syntax

   docker run --log-driver=syslog myimage uses --log-driver=syslog, which is the correct syntax.

3. Final Answer:

   docker run --log-driver=syslog myimage -> Option A

4. Quick Check:

   Use --log-driver to set logging driver [OK]

Hint: Use --log-driver=driver_name to set logging driver [OK]

Common Mistakes:

• Using --logging instead of --log-driver
• Missing the dash in --log-driver
• Using --log instead of --log-driver

3. Given the command:
docker run --log-driver=json-file --log-opt max-size=10m --log-opt max-file=3 alpine echo hello
What will happen when the container logs exceed 30 MB?

medium

A. Logs will grow indefinitely without rotation

B. Logs will be deleted immediately after 30 MB

C. Logs will be rotated and only the latest 3 files of 10 MB each are kept

D. Container will stop running when logs exceed 30 MB

Solution

1. Step 1: Understand log options max-size and max-file

   max-size=10m means each log file max is 10 MB; max-file=3 means keep 3 rotated files.

2. Step 2: Calculate total log size before rotation

   3 files x 10 MB each = 30 MB total before old logs are deleted.

3. Final Answer:

   Logs will be rotated and only the latest 3 files of 10 MB each are kept -> Option C

4. Quick Check:

   max-size and max-file control log rotation [OK]

Hint: max-size x max-file = total log size before rotation [OK]

Common Mistakes:

• Thinking logs delete immediately at 30 MB
• Assuming container stops on log size limit
• Ignoring max-file setting

4. You run a container with:
docker run --log-driver=none nginx
But you still see logs when running docker logs. What is the likely cause?

medium

A. The --log-driver=none flag is invalid and ignored

B. The container was started before the logging driver was set to none

C. Docker logs command shows logs from the host system

D. The container image nginx forces logging regardless of driver

Solution

1. Step 1: Understand effect of --log-driver=none

   This disables logging for the container started with this flag.

2. Step 2: Consider container start timing

   If the container was started before setting the flag, old logs remain accessible.

3. Final Answer:

   The container was started before the logging driver was set to none -> Option B

4. Quick Check:

   Logging driver applies only at container start [OK]

Hint: Logging driver must be set when container starts [OK]

Common Mistakes:

• Assuming --log-driver=none is invalid
• Thinking docker logs shows host logs
• Believing image controls logging driver

5. You want to configure Docker daemon to use the journald logging driver by default and limit log file size to 5 MB with 2 rotated files. Which daemon.json configuration is correct?

hard

A. {
"log-driver": "journald",
"log-opts": {
"max-size": "5m",
"max-file": "2"
}
}

B. {
"logging-driver": "journald",
"logging-opts": {
"max-size": "5m",
"max-file": "2"
}
}

C. {
"log-driver": "journald",
"log-opts": {
"max-size": 5,
"max-file": 2
}
}

D. {
"log-driver": "journald",
"log-opts": {
"max-size": "5MB",
"max-file": "2"
}
}

Solution

1. Step 1: Identify correct keys in daemon.json

   The keys are "log-driver" and "log-opts" (not "logging-driver" or "logging-opts").

2. Step 2: Check value formats for options

   max-size must be a string with units like "5m" (not number or "5MB" which is invalid).

3. Final Answer:

   { "log-driver": "journald", "log-opts": { "max-size": "5m", "max-file": "2" } } -> Option A

4. Quick Check:

   Use "log-driver" and string values with units [OK]

Hint: Use "log-driver" and string sizes like "5m" in daemon.json [OK]

Common Mistakes:

• Using wrong keys like logging-driver
• Using numeric values without units
• Using invalid units like MB instead of m