Docker logging drivers - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Docker logging driver?

A Docker logging driver is a tool that controls how and where Docker container logs are stored or sent. It helps collect logs from containers for monitoring and troubleshooting.

beginner

Name three common Docker logging drivers.

Common Docker logging drivers include: json-file (default), syslog, and journald. Each sends logs to different places or formats.

beginner

How do you set a logging driver for a Docker container?

Use the option --log-driver when running a container, for example: docker run --log-driver=syslog alpine echo hello

beginner

What is the default Docker logging driver and what format does it use?

The default logging driver is json-file. It stores logs as JSON-formatted files on the host machine.

intermediate

Why might you choose the syslog logging driver over the default?

Syslog sends logs to the system's centralized logging service, making it easier to manage logs from many containers in one place.

Which Docker logging driver stores logs as JSON files on the host?

A syslog

B journald

C json-file

D none

The json-file driver stores container logs as JSON files on the host machine.

How do you specify a logging driver when starting a Docker container?

A docker build --log-driver=driver_name

B docker run --log-driver=driver_name

C docker create --log-driver=driver_name

D docker start --log-driver=driver_name

The --log-driver option is used with docker run to set the logging driver.

Which logging driver sends logs to the system's centralized logging service on Linux?

A journald

B none

C json-file

D fluentd

The journald driver sends logs to systemd's journal service on Linux.

What happens if you set the logging driver to 'none'?

A No logs are collected

B Logs are sent to syslog

C Logs are stored in JSON files

D Logs are sent to journald

The 'none' logging driver disables log collection for the container.

Why use a logging driver like fluentd?

A To format logs as plain text files

B To store logs only on the local host

C To disable logging

D To send logs to a centralized log collector for analysis

Fluentd driver sends logs to a centralized collector for easier log management and analysis.

Explain what a Docker logging driver is and why it is important.

Think about how logs help you understand what your container is doing.

Describe how to change the logging driver for a Docker container and give an example.

Remember the command you use to start containers.

Practice

1. What is the default Docker logging driver used if none is specified?

easy

A. none

B. syslog

C. journald

D. json-file

Solution

1. Step 1: Understand Docker default logging behavior

   Docker uses a default logging driver to store container logs unless changed.

2. Step 2: Identify the default driver

   The default driver is json-file, which stores logs as JSON files on the host.

3. Final Answer:

   json-file -> Option D

4. Quick Check:

   Default logging driver = json-file [OK]

Hint: Default is json-file unless changed in daemon config [OK]

Common Mistakes:

• Choosing syslog as default
• Thinking none disables logging by default
• Confusing journald with default

2. Which of the following is the correct syntax to set the logging driver to syslog when running a container?

easy

A. docker run --log-driver=syslog myimage

B. docker run --logging=syslog myimage

C. docker run --logdriver=syslog myimage

D. docker run --log syslog myimage

Solution

1. Step 1: Recall Docker run command options for logging

   The correct flag to specify logging driver is --log-driver.

2. Step 2: Match the correct syntax

   docker run --log-driver=syslog myimage uses --log-driver=syslog, which is the correct syntax.

3. Final Answer:

   docker run --log-driver=syslog myimage -> Option A

4. Quick Check:

   Use --log-driver to set logging driver [OK]

Hint: Use --log-driver=driver_name to set logging driver [OK]

Common Mistakes:

• Using --logging instead of --log-driver
• Missing the dash in --log-driver
• Using --log instead of --log-driver

3. Given the command:
docker run --log-driver=json-file --log-opt max-size=10m --log-opt max-file=3 alpine echo hello
What will happen when the container logs exceed 30 MB?

medium

A. Logs will grow indefinitely without rotation

B. Logs will be deleted immediately after 30 MB

C. Logs will be rotated and only the latest 3 files of 10 MB each are kept

D. Container will stop running when logs exceed 30 MB

Solution

1. Step 1: Understand log options max-size and max-file

   max-size=10m means each log file max is 10 MB; max-file=3 means keep 3 rotated files.

2. Step 2: Calculate total log size before rotation

   3 files x 10 MB each = 30 MB total before old logs are deleted.

3. Final Answer:

   Logs will be rotated and only the latest 3 files of 10 MB each are kept -> Option C

4. Quick Check:

   max-size and max-file control log rotation [OK]

Hint: max-size x max-file = total log size before rotation [OK]

Common Mistakes:

• Thinking logs delete immediately at 30 MB
• Assuming container stops on log size limit
• Ignoring max-file setting

4. You run a container with:
docker run --log-driver=none nginx
But you still see logs when running docker logs. What is the likely cause?

medium

A. The --log-driver=none flag is invalid and ignored

B. The container was started before the logging driver was set to none

C. Docker logs command shows logs from the host system

D. The container image nginx forces logging regardless of driver

Solution

1. Step 1: Understand effect of --log-driver=none

   This disables logging for the container started with this flag.

2. Step 2: Consider container start timing

   If the container was started before setting the flag, old logs remain accessible.

3. Final Answer:

   The container was started before the logging driver was set to none -> Option B

4. Quick Check:

   Logging driver applies only at container start [OK]

Hint: Logging driver must be set when container starts [OK]

Common Mistakes:

• Assuming --log-driver=none is invalid
• Thinking docker logs shows host logs
• Believing image controls logging driver

5. You want to configure Docker daemon to use the journald logging driver by default and limit log file size to 5 MB with 2 rotated files. Which daemon.json configuration is correct?

hard

A. {
"log-driver": "journald",
"log-opts": {
"max-size": "5m",
"max-file": "2"
}
}

B. {
"logging-driver": "journald",
"logging-opts": {
"max-size": "5m",
"max-file": "2"
}
}

C. {
"log-driver": "journald",
"log-opts": {
"max-size": 5,
"max-file": 2
}
}

D. {
"log-driver": "journald",
"log-opts": {
"max-size": "5MB",
"max-file": "2"
}
}

Solution

1. Step 1: Identify correct keys in daemon.json

   The keys are "log-driver" and "log-opts" (not "logging-driver" or "logging-opts").

2. Step 2: Check value formats for options

   max-size must be a string with units like "5m" (not number or "5MB" which is invalid).

3. Final Answer:

   { "log-driver": "journald", "log-opts": { "max-size": "5m", "max-file": "2" } } -> Option A

4. Quick Check:

   Use "log-driver" and string values with units [OK]

Hint: Use "log-driver" and string sizes like "5m" in daemon.json [OK]

Common Mistakes:

• Using wrong keys like logging-driver
• Using numeric values without units
• Using invalid units like MB instead of m