Skip to Content

Docker logging driver configuration - json-file and journald

Need to push logs from containers somewhere else? Let's look how to change default log driver!

Share on:

Docker allows us to stream logs to different places with plugins called logging drivers.

How to change logging driver? What’s the most popular ones?

What is logging driver?

Docker has got two types of logging drivers:

  • built-in like:
    • awslogs
    • fluentd
    • gcplogs
    • gelf
    • journald
    • json-file
    • local
    • logentries
    • splunk
    • syslog
  • external drivers that we can install with docker plugin install

Logging driver is used to forward logs from containers to specific log aggregators, widely known rsyslog or fluentd for example.

Default logging driver after installation is json-file.

It is important to test non default logging drivers before using on production - problems with logging can cause crash/hang or startup problems with containers.

Check default logging driver

This is driver that docker daemon will use for itself and containers that won’t have set explicit another driver at start

[lukas@docker-host1 ~]$ docker info --format '{{.LoggingDriver}}'
json-file

Check logging driver for running container

[lukas@docker-host1 docker]# docker container ls
CONTAINER ID        IMAGE               COMMAND              CREATED              STATUS              PORTS               NAMES
7e0f1ab24716        httpd               "httpd-foreground"   About a minute ago   Up About a minute   80/tcp              web_server_httpd

[lukas@docker-host1 docker]# docker inspect -f '{{.HostConfig.LogConfig.Type}}' web_server_httpd
json-file

Log location - container with json-file driver

[lukas@docker-host1 docker]# docker container inspect web_server_httpd --format "{{.LogPath}}"
/var/lib/docker/containers/7e0f1ab2471674b020f39a03e6c1cc49f8c70378acb5ca94d4323dc2cbeecb68/7e0f1ab2471674b020f39a03e6c1cc49f8c70378acb5ca94d4323dc2cbeecb68-json.log

Logs from docker cli command

This command will work fine with default ‘json-log’ driver, can fail with non default ones

[lukas@docker-host1 docker]# docker logs web_server_httpd
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
[Tue May 05 13:28:43.383499 2020] [mpm_event:notice] [pid 1:tid 140713807934592] AH00489: Apache/2.4.43 (Unix) configured -- resuming normal operations
[Tue May 05 13:28:43.405939 2020] [core:notice] [pid 1:tid 140713807934592] AH00094: Command line: 'httpd -D FOREGROUND'

Set default logging driver

We can set default log-driver in /etc/docker/daemon.json. Format:

{
  "log-driver": "<log_driver_name>",
  "log-opts": {
    "<log_opt1_name>": "<log_opt1_value>",
    "<log_opt2_name>": "<log_opt2_value>"
  }
}

log_opts for json-file

  • max-size - max file size
  • max-file - max number of files
  • labels - list of keys of labels hat should be in log - if container has them set
  • env - list of variables that should be in log - if container has them set

Change logging driver to journald

[root@docker-host1 ~]# vi /etc/docker/daemon.json
{
    "log-driver": "journald
}

As in json-file we can optionally add another parameter log_opts to set some flags for journald driver:

  • tag - Use to change CONTAINER_TAG and SYSLOG_IDENTIFIER
  • labels - list of keys of labels hat should be in log - if container has them set
  • env - list of variables that should be in log - if container has them set

After configuration change we should restart docker daemon:

[root@docker-host1 ~]# systemctl restart docker

After starting container we can check his logs with journalctl command

[lukas@docker-host1 ~]# docker run -d --name web_server_httpd httpd

[lukas@docker-host1 ~]# journalctl CONTAINER_NAME=web_server_httpd
-- Logs begin at Tue 2020-05-05 16:08:42 CEST, end at Tue 2020-05-05 16:12:28 CEST. --
May 05 16:12:28 docker-host1.lukas.int 5c331ed1a91b[1752]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the >
May 05 16:12:28 docker-host1.lukas.int 5c331ed1a91b[1752]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the >
May 05 16:12:28 docker-host1.lukas.int 5c331ed1a91b[1752]: [Tue May 05 14:12:28.492926 2020] [mpm_event:notice] [pid 1:tid 140110908605568] AH00489: Apache/2.4.43 (Unix) co>
May 05 16:12:28 docker-host1.lukas.int 5c331ed1a91b[1752]: [Tue May 05 14:12:28.517394 2020] [core:notice] [pid 1:tid 140110908605568] AH00094: Command line: 'httpd -D FORE>

Your non priliged user should be in systemd-journal OS group to use journalctl command

Set logging driver at container level

We have now as default configured journald - but we can override this when starting container

[lukas@docker-host1 ~]$ docker run -d --name web_server --log-driver json-file httpd
9427635d3943c2cf7fa48f0fe82f00b06bd5026619151437858ec9d40bc1b7ad

We can also set options for driver with --log-opt followed by < key >=< value >.
For multiple flags we add multiple --log-opt params.