New Docker Logging Drivers | Sumo Logic Blog
Sign Up Free Request Demo

New Docker Logging Drivers

New Docker Logging Drivers

Docker Release 1.6 introduces the notion of a logging driver. This is a very cool capability and a huge step forward in creating a comprehensive approach to logging in Docker environments.

It is now possible to route container output (stdout and stderr) to syslog. It is also possible to completely suppress the writing of container output to file, which can help in situations where disk space usage is of importance. This post will also show how easy it is to integrate the syslog logging driver with Sumo Logic.

Let’s review for a second. Docker has been supporting logging of a container’s standard output and standard error streams to file for a while. You can see how this works in this quick example:

$ CID=$(docker run -d ubuntu echo "Hello")
$ echo $CID
$ sudo cat /var/lib/docker/containers/$CID/$CID-json.log

What happened here? Our container simply outputs Hello. This output will go to the standard output of the container. By default, Docker will write the output wrapped into JSON into a specific file named after the container ID, in a directory under /var/lib/docker/containers named after the container ID.

Logging the Container Output to Syslog

With the new logging drivers capability, it is possible to select the logging behavior when running a container. In addition to the default json-file driver, there is now also a syslog driver supported. To see this in action, do this in one terminal window:

$ tail -F /var/log/syslog

Then, in another terminal window, do this:

$ docker run -d --log-driver=syslog ubuntu echo "Hello"

When running the container, you should see something along these lines in the tailed syslog file:

Mar 29 17:39:01 dev1 docker[116314]: 0e5b67244c00: Hello

Cool! Based on the --log-driver flag, which is set to syslog here, syslog received a message from the Docker daemon, which includes the container ID (well, the first 12 characters anyways), plus the actual output of the container. In this case of course, the output was just a simple message. To generate more messages, something like this will do the trick:

$ docker run -t -d --log-driver=syslog ubuntu \
    /bin/bash -c 'while true; do echo "Hello $(date)"; sleep 1; done'

While still tailing the syslog file, a new log message should appear every minute.

Completely Suppressing the Container Output

Notably, when the logging driver is set to syslog, Docker sends the container output only to syslog, and not to file. This helps in managing disk space. Docker’s default behavior of writing container output to file can cause pain in managing disk space on the host. If a lot of containers are running on the host, and logging to standard out and standard error are used (as recommended for containerized apps) then some sort of space management for those files has to be bolted on, or the host eventually runs out of disk space. This is obviously not great. But now, there is also a none option for the logging driver, which will essentially dev-null the container output.

$ CID=$(docker run -d --log-driver=none ubuntu \
         /bin/bash -c 'while true; do echo "Hello"; sleep 1; done')
$ sudo cat /var/lib/docker/containers/$CID/$CID-json.log
cat: /var/lib/docker/containers/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4-json.log: No such file or directory

However, this will also disable the Logs API, so the docker logs CLI will also not work anymore, and neither will the /logs API endpoint. This means that if you are using for example Logspout to ship logs off the Docker host, you will still have to use the default json-file option.

Integrating the Sumo Logic Collector With the New Syslog Logging Driver

In a previous blog, we described how to use the Sumo Logic Collector images to get container logs to Sumo Logic. We have prepared an image that extends the framework developed in the previous post. You can get all the logs into Sumo Logic by running with the syslog logging driver and running the Sumo Logic Collector on the host:

$ docker run -v /var/log/syslog:/syslog -d \
    --name="sumo-logic-collector" \
    sumologic/collector:latest-logging-driver-syslog \
    [Access ID] [Access Key]

As a Sumo Logic user, it is very easy to generate the required access key by going to the Preferences page. And that’s it folks. Select the syslog logging driver, and add the Sumo Logic Collector container to your hosts, and all the container logs will go into one place for analysis and troubleshooting.

Get Started Today!

Sign up for your FREE Sumo Logic Trial.

Sign Up Free

Request a Demo

Thank you! We will get in touch with you shortly to schedule your Sumo Logic demo.
“Sumo Logic brings everything together into one interface where we can quickly scan across 1,000 servers and gigabytes of logs and quickly identify problems. It’s awesome software and awesome support.”

Jon Dokuli,
VP of Engineering

Thank you for signing up for Sumo Logic.

We are creating your account now.
Please check your email.
Need more help? Contact Us
Sign up for Sumo Logic Free*
Sign up for Sumo Logic Free*
  • No credit card required to sign-up
  • Create your account in minutes
  • No expiration date*
  • *After 30 day trial period, reverts to Sumo Logic Free
    • Please Enter your email address.
    • Please enter a valid email address.
    • This email is already in use for another account.
    • Please use your company email to create an account.
    • Please agree to the Service License.
    • Free trial provisioning is temporarily offline, please call 855-LOG-SUMO to get started.
    View All Pricing Options
    Already have an account? Login