Why Docker logging drivers? - Purpose & Use Cases

The Big Idea

What if you could find any container error in seconds instead of hours?

The Scenario

Imagine running many Docker containers on different servers and trying to find error messages by manually checking each container's logs one by one.

The Problem

This manual approach is slow and confusing because logs are scattered everywhere. You might miss important errors or waste hours searching through long log files.

The Solution

Docker logging drivers let you automatically send container logs to a central place or format them nicely. This makes it easy to collect, search, and analyze logs without digging through each container manually.

Before vs After

✗ Before

docker logs container1
docker logs container2

✓ After

docker run --log-driver=json-file myapp
# or
docker run --log-driver=syslog myapp

What It Enables

It enables easy, organized, and scalable log management across many containers and hosts.

Real Life Example

A company runs dozens of microservices in containers and uses a logging driver to send all logs to a central system like the ELK stack, so developers quickly find and fix issues.

Key Takeaways

Manual log checking is slow and error-prone.

Logging drivers automate and centralize log collection.

This saves time and helps keep applications healthy.

Practice

1. What is the default Docker logging driver used if none is specified?

easy

A. none

B. syslog

C. journald

D. json-file

Solution

1. Step 1: Understand Docker default logging behavior

   Docker uses a default logging driver to store container logs unless changed.

2. Step 2: Identify the default driver

   The default driver is json-file, which stores logs as JSON files on the host.

3. Final Answer:

   json-file -> Option D

4. Quick Check:

   Default logging driver = json-file [OK]

Hint: Default is json-file unless changed in daemon config [OK]

Common Mistakes:

• Choosing syslog as default
• Thinking none disables logging by default
• Confusing journald with default

2. Which of the following is the correct syntax to set the logging driver to syslog when running a container?

easy

A. docker run --log-driver=syslog myimage

B. docker run --logging=syslog myimage

C. docker run --logdriver=syslog myimage

D. docker run --log syslog myimage

Solution

1. Step 1: Recall Docker run command options for logging

   The correct flag to specify logging driver is --log-driver.

2. Step 2: Match the correct syntax

   docker run --log-driver=syslog myimage uses --log-driver=syslog, which is the correct syntax.

3. Final Answer:

   docker run --log-driver=syslog myimage -> Option A

4. Quick Check:

   Use --log-driver to set logging driver [OK]

Hint: Use --log-driver=driver_name to set logging driver [OK]

Common Mistakes:

• Using --logging instead of --log-driver
• Missing the dash in --log-driver
• Using --log instead of --log-driver

3. Given the command:
docker run --log-driver=json-file --log-opt max-size=10m --log-opt max-file=3 alpine echo hello
What will happen when the container logs exceed 30 MB?

medium

A. Logs will grow indefinitely without rotation

B. Logs will be deleted immediately after 30 MB

C. Logs will be rotated and only the latest 3 files of 10 MB each are kept

D. Container will stop running when logs exceed 30 MB

Solution

1. Step 1: Understand log options max-size and max-file

   max-size=10m means each log file max is 10 MB; max-file=3 means keep 3 rotated files.

2. Step 2: Calculate total log size before rotation

   3 files x 10 MB each = 30 MB total before old logs are deleted.

3. Final Answer:

   Logs will be rotated and only the latest 3 files of 10 MB each are kept -> Option C

4. Quick Check:

   max-size and max-file control log rotation [OK]

Hint: max-size x max-file = total log size before rotation [OK]

Common Mistakes:

• Thinking logs delete immediately at 30 MB
• Assuming container stops on log size limit
• Ignoring max-file setting

4. You run a container with:
docker run --log-driver=none nginx
But you still see logs when running docker logs. What is the likely cause?

medium

A. The --log-driver=none flag is invalid and ignored

B. The container was started before the logging driver was set to none

C. Docker logs command shows logs from the host system

D. The container image nginx forces logging regardless of driver

Solution

1. Step 1: Understand effect of --log-driver=none

   This disables logging for the container started with this flag.

2. Step 2: Consider container start timing

   If the container was started before setting the flag, old logs remain accessible.

3. Final Answer:

   The container was started before the logging driver was set to none -> Option B

4. Quick Check:

   Logging driver applies only at container start [OK]

Hint: Logging driver must be set when container starts [OK]

Common Mistakes:

• Assuming --log-driver=none is invalid
• Thinking docker logs shows host logs
• Believing image controls logging driver

5. You want to configure Docker daemon to use the journald logging driver by default and limit log file size to 5 MB with 2 rotated files. Which daemon.json configuration is correct?

hard

A. {
"log-driver": "journald",
"log-opts": {
"max-size": "5m",
"max-file": "2"
}
}

B. {
"logging-driver": "journald",
"logging-opts": {
"max-size": "5m",
"max-file": "2"
}
}

C. {
"log-driver": "journald",
"log-opts": {
"max-size": 5,
"max-file": 2
}
}

D. {
"log-driver": "journald",
"log-opts": {
"max-size": "5MB",
"max-file": "2"
}
}

Solution

1. Step 1: Identify correct keys in daemon.json

   The keys are "log-driver" and "log-opts" (not "logging-driver" or "logging-opts").

2. Step 2: Check value formats for options

   max-size must be a string with units like "5m" (not number or "5MB" which is invalid).

3. Final Answer:

   { "log-driver": "journald", "log-opts": { "max-size": "5m", "max-file": "2" } } -> Option A

4. Quick Check:

   Use "log-driver" and string values with units [OK]

Hint: Use "log-driver" and string sizes like "5m" in daemon.json [OK]

Common Mistakes:

• Using wrong keys like logging-driver
• Using numeric values without units
• Using invalid units like MB instead of m