Free Trial

New Docker Logging Drivers

New Docker Logging Drivers

Docker Release 1.6 introduces the notion of a logging driver. This is a very cool capability and a huge step forward in creating a comprehensive approach to logging in Docker environments.

It is now possible to route container output (stdout and stderr) to syslog. It is also possible to completely suppress the writing of container output to file, which can help in situations where disk space usage is of importance. This post will also show how easy it is to integrate the syslog logging driver with Sumo Logic.

Let’s review for a second. Docker has been supporting logging of a container’s standard output and standard error streams to file for a while. You can see how this works in this quick example:

$ CID=$(docker run -d ubuntu echo "Hello")
$ echo $CID
5594248e11b7d4d40cfec4737c7e4b7577fe1e665cf033439522fbf4f9c4e2d5
$ sudo cat /var/lib/docker/containers/$CID/$CID-json.log
{"log":"Hello\n","stream":"stdout","time":"2015-03-30T00:34:58.782658342Z"}

What happened here? Our container simply outputs Hello. This output will go to the standard output of the container. By default, Docker will write the output wrapped into JSON into a specific file named after the container ID, in a directory under /var/lib/docker/containers named after the container ID.

Logging the Container Output to Syslog

With the new logging drivers capability, it is possible to select the logging behavior when running a container. In addition to the default json-file driver, there is now also a syslog driver supported. To see this in action, do this in one terminal window:

$ tail -F /var/log/syslog

Then, in another terminal window, do this:

$ docker run -d --log-driver=syslog ubuntu echo "Hello"

When running the container, you should see something along these lines in the tailed syslog file:

Mar 29 17:39:01 dev1 docker[116314]: 0e5b67244c00: Hello

Cool! Based on the --log-driver flag, which is set to syslog here, syslog received a message from the Docker daemon, which includes the container ID (well, the first 12 characters anyways), plus the actual output of the container. In this case of course, the output was just a simple message. To generate more messages, something like this will do the trick:

$ docker run -t -d --log-driver=syslog ubuntu \
    /bin/bash -c 'while true; do echo "Hello $(date)"; sleep 1; done'

While still tailing the syslog file, a new log message should appear every minute.

Completely Suppressing the Container Output

Notably, when the logging driver is set to syslog, Docker sends the container output only to syslog, and not to file. This helps in managing disk space. Docker’s default behavior of writing container output to file can cause pain in managing disk space on the host. If a lot of containers are running on the host, and logging to standard out and standard error are used (as recommended for containerized apps) then some sort of space management for those files has to be bolted on, or the host eventually runs out of disk space. This is obviously not great. But now, there is also a none option for the logging driver, which will essentially dev-null the container output.

$ CID=$(docker run -d --log-driver=none ubuntu \
         /bin/bash -c 'while true; do echo "Hello"; sleep 1; done')
$ sudo cat /var/lib/docker/containers/$CID/$CID-json.log
cat: /var/lib/docker/containers/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4-json.log: No such file or directory

However, this will also disable the Logs API, so the docker logs CLI will also not work anymore, and neither will the /logs API endpoint. This means that if you are using for example Logspout to ship logs off the Docker host, you will still have to use the default json-file option.

Integrating the Sumo Logic Collector With the New Syslog Logging Driver

In a previous blog, we described how to use the Sumo Logic Collector images to get container logs to Sumo Logic. We have prepared an image that extends the framework developed in the previous post. You can get all the logs into Sumo Logic by running with the syslog logging driver and running the Sumo Logic Collector on the host:

$ docker run -v /var/log/syslog:/syslog -d \
    --name="sumo-logic-collector" \
    sumologic/collector:latest-logging-driver-syslog \
    [Access ID] [Access Key]

As a Sumo Logic user, it is very easy to generate the required access key by going to the Preferences page. And that’s it folks. Select the syslog logging driver, and add the Sumo Logic Collector container to your hosts, and all the container logs will go into one place for analysis and troubleshooting.

Get Started Today!

Sign up for your FREE Sumo Logic Trial.

Free Trial
“Sumo Logic brings everything together into one interface 
where we Hudl can quickly scan across 1,000 servers across and gigabytes of logs and quickly identify problems. It’s awesome software 
and awesome support.”

Jon Dokuli,
VP of Engineering

Sign up for your 30 day free trial!*
Sign up for Sumo Logic Free
  • No credit card required to sign-up
  • Create your account in minutes
  • No expiration date*
  • *After 30 day trial period, reverts to Sumo Logic Free
    View All Pricing Options
    Already have an account? Login