Docker logging drivers - Step-by-Step Execution

Process Flow - Docker logging drivers

Start Container

↓

Container Writes Logs

↓

Docker Captures Logs

↓

Logs Sent to Logging Driver

↓

Logging Driver Processes Logs

↓

Logs Stored or Forwarded

↓

User Views Logs via Docker or External Tool

This flow shows how Docker captures container logs and sends them to the chosen logging driver, which then stores or forwards the logs for user access.

Execution Sample

Docker

docker run --log-driver json-file alpine echo hello

docker logs <container_id>

Run a container with the json-file logging driver and then view its logs.

Process Table

Step	Action	Logging Driver	Log Captured	Log Stored/Forwarded	User Output
1	Start container with --log-driver json-file	json-file	No logs yet	No logs yet	No output
2	Container runs command 'echo hello'	json-file	Captured 'hello\n'	Stored in json-file log	No output yet
3	User runs 'docker logs <container_id>'	json-file	Logs already captured	Logs read from json-file	Output: 'hello'
4	Container stops	json-file	No new logs	Logs remain stored	No output
5	Start container with --log-driver syslog	syslog	No logs yet	No logs yet	No output
6	Container runs command 'echo hello'	syslog	Captured 'hello\n'	Forwarded to syslog daemon	No output yet
7	User checks syslog externally	syslog	Logs forwarded	Logs stored in syslog	Output: 'hello' in syslog
8	User runs 'docker logs <container_id>'	syslog	Logs forwarded	Logs not stored locally	Output: empty
9	Container stops	syslog	No new logs	Logs remain in syslog	No output
10	Start container with --log-driver none	none	No logs captured	No logs stored or forwarded	No output
11	Container runs command 'echo hello'	none	No logs captured	No logs stored or forwarded	No output
12	User runs 'docker logs <container_id>'	none	No logs	No logs	Output: '' (empty)

💡 Execution stops after container stops or user finishes checking logs.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6	After Step 7	After Step 8	After Step 10	After Step 11	After Step 12
Logging Driver	json-file	json-file	json-file	json-file	syslog	syslog	syslog	none	none	none
Logs Captured	No logs	hello\n	hello\n	hello\n	hello\n	hello\n	hello\n	No logs	No logs	No logs
Logs Stored/Forwarded	No logs	Stored in json-file	Stored in json-file	Stored in json-file	Forwarded to syslog	Forwarded to syslog	Forwarded to syslog	No logs	No logs	No logs
User Output	No output	No output	hello	No output	No output	hello in syslog	empty	No output	No output	Empty

Key Moments - 3 Insights

Why does 'docker logs' show no output when using the syslog logging driver?

Because the syslog driver forwards logs to the system's syslog service and does not store logs locally for 'docker logs' to read, as shown in execution_table step 8.

What happens to logs when the 'none' logging driver is used?

No logs are captured, stored, or forwarded, so 'docker logs' returns empty output, as seen in execution_table steps 10-12.

How does the json-file logging driver handle logs?

It captures logs and stores them locally in JSON format, allowing 'docker logs' to display them, demonstrated in execution_table steps 2-3.

Visual Quiz - 3 Questions

Look at the execution table, at which step does the user see the output 'hello' using the json-file driver?

A Step 8

B Step 6

C Step 3

D Step 12

💡 Hint

Check the 'User Output' column for the json-file driver rows in the execution_table.

According to the variable tracker, what is the state of 'Logs Captured' after step 11 with the 'none' driver?

A No logs

B 'hello\n'

C Stored in json-file

D Forwarded to syslog

💡 Hint

Look at the 'Logs Captured' row under 'After Step 11' in variable_tracker.

If you switch from 'json-file' to 'syslog' driver, what changes in the 'User Output' when running 'docker logs'?

A Output becomes empty string

B Output changes from 'hello' to 'empty'

C Output remains 'hello'

D Output shows error message

💡 Hint

Compare 'User Output' for json-file at step 3 and syslog at step 8 in execution_table.

Concept Snapshot

Docker logging drivers control where container logs go.
Common drivers: json-file (default, stores locally), syslog (forwards to system), none (no logs).
Use --log-driver option when running containers.
'docker logs' works only if logs are stored locally.
Choose driver based on your log management needs.

Full Transcript

Docker logging drivers decide how container logs are handled. When a container runs, it writes logs. Docker captures these logs and sends them to the chosen logging driver. The driver either stores logs locally, forwards them to an external system, or discards them. For example, the json-file driver stores logs in a file, so 'docker logs' can show them. The syslog driver sends logs to the system's syslog service, so 'docker logs' may show no output. The none driver disables logging. Users select the driver with the --log-driver option when starting containers. Understanding this helps manage logs effectively.

Practice

1. What is the default Docker logging driver used if none is specified?

easy

A. none

B. syslog

C. journald

D. json-file

Solution

1. Step 1: Understand Docker default logging behavior

   Docker uses a default logging driver to store container logs unless changed.

2. Step 2: Identify the default driver

   The default driver is json-file, which stores logs as JSON files on the host.

3. Final Answer:

   json-file -> Option D

4. Quick Check:

   Default logging driver = json-file [OK]

Hint: Default is json-file unless changed in daemon config [OK]

Common Mistakes:

• Choosing syslog as default
• Thinking none disables logging by default
• Confusing journald with default

2. Which of the following is the correct syntax to set the logging driver to syslog when running a container?

easy

A. docker run --log-driver=syslog myimage

B. docker run --logging=syslog myimage

C. docker run --logdriver=syslog myimage

D. docker run --log syslog myimage

Solution

1. Step 1: Recall Docker run command options for logging

   The correct flag to specify logging driver is --log-driver.

2. Step 2: Match the correct syntax

   docker run --log-driver=syslog myimage uses --log-driver=syslog, which is the correct syntax.

3. Final Answer:

   docker run --log-driver=syslog myimage -> Option A

4. Quick Check:

   Use --log-driver to set logging driver [OK]

Hint: Use --log-driver=driver_name to set logging driver [OK]

Common Mistakes:

• Using --logging instead of --log-driver
• Missing the dash in --log-driver
• Using --log instead of --log-driver

3. Given the command:
docker run --log-driver=json-file --log-opt max-size=10m --log-opt max-file=3 alpine echo hello
What will happen when the container logs exceed 30 MB?

medium

A. Logs will grow indefinitely without rotation

B. Logs will be deleted immediately after 30 MB

C. Logs will be rotated and only the latest 3 files of 10 MB each are kept

D. Container will stop running when logs exceed 30 MB

Solution

1. Step 1: Understand log options max-size and max-file

   max-size=10m means each log file max is 10 MB; max-file=3 means keep 3 rotated files.

2. Step 2: Calculate total log size before rotation

   3 files x 10 MB each = 30 MB total before old logs are deleted.

3. Final Answer:

   Logs will be rotated and only the latest 3 files of 10 MB each are kept -> Option C

4. Quick Check:

   max-size and max-file control log rotation [OK]

Hint: max-size x max-file = total log size before rotation [OK]

Common Mistakes:

• Thinking logs delete immediately at 30 MB
• Assuming container stops on log size limit
• Ignoring max-file setting

4. You run a container with:
docker run --log-driver=none nginx
But you still see logs when running docker logs. What is the likely cause?

medium

A. The --log-driver=none flag is invalid and ignored

B. The container was started before the logging driver was set to none

C. Docker logs command shows logs from the host system

D. The container image nginx forces logging regardless of driver

Solution

1. Step 1: Understand effect of --log-driver=none

   This disables logging for the container started with this flag.

2. Step 2: Consider container start timing

   If the container was started before setting the flag, old logs remain accessible.

3. Final Answer:

   The container was started before the logging driver was set to none -> Option B

4. Quick Check:

   Logging driver applies only at container start [OK]

Hint: Logging driver must be set when container starts [OK]

Common Mistakes:

• Assuming --log-driver=none is invalid
• Thinking docker logs shows host logs
• Believing image controls logging driver

5. You want to configure Docker daemon to use the journald logging driver by default and limit log file size to 5 MB with 2 rotated files. Which daemon.json configuration is correct?

hard

A. {
"log-driver": "journald",
"log-opts": {
"max-size": "5m",
"max-file": "2"
}
}

B. {
"logging-driver": "journald",
"logging-opts": {
"max-size": "5m",
"max-file": "2"
}
}

C. {
"log-driver": "journald",
"log-opts": {
"max-size": 5,
"max-file": 2
}
}

D. {
"log-driver": "journald",
"log-opts": {
"max-size": "5MB",
"max-file": "2"
}
}

Solution

1. Step 1: Identify correct keys in daemon.json

   The keys are "log-driver" and "log-opts" (not "logging-driver" or "logging-opts").

2. Step 2: Check value formats for options

   max-size must be a string with units like "5m" (not number or "5MB" which is invalid).

3. Final Answer:

   { "log-driver": "journald", "log-opts": { "max-size": "5m", "max-file": "2" } } -> Option A

4. Quick Check:

   Use "log-driver" and string values with units [OK]

Hint: Use "log-driver" and string sizes like "5m" in daemon.json [OK]

Common Mistakes:

• Using wrong keys like logging-driver
• Using numeric values without units
• Using invalid units like MB instead of m