--- title: "New docker logging drivers" page_name: "New Docker Logging Drivers" type: "blog" slug: "new-docker-logging-drivers" published_at: "2015-04-16" modified_at: "2026-02-10" url: "https://www.sumologic.com/blog/new-docker-logging-drivers" canonical: "https://www.sumologic.com/blog/new-docker-logging-drivers" markdown_url: "https://www.sumologic.com/blog/new-docker-logging-drivers.md" lang: "en" excerpt: "Review of Docker Release 1.6 - a very cool capability and a huge step forward in creating a comprehensive approach to logging in Docker environments." taxonomy_blog_category: - "Containers" --- [ All blogs ](https://www.sumologic.com/blog "blog")[Containers](https://www.sumologic.com/blog/containers) # New Docker Logging Drivers [Christian Beedgen](#blog-author-block-83) April 16, 2015 3 min read [Containers](https://www.sumologic.com/blog/containers) ##### Table of contents Docker [Release 1.6](https://github.com/docker/docker/commit/c5ee1494af86a71b76d4d5066528a7b141e83185) introduces the notion of a logging driver. This is a very cool capability and a huge step forward in creating a comprehensive approach to logging in Docker environments. It is now possible to route container output (stdout and stderr) to [syslog](https://www.sumologic.com/syslog/). It is also possible to completely suppress the writing of container output to file, which can help in situations where disk space usage is of importance. This post will also show how easy it is to integrate the `syslog` logging driver with Sumo Logic. Let’s review for a second. Docker has been supporting logging of a container’s standard output and standard error streams to file for a while. You can see how this works in this quick example: <pre class=”brush: plain; title: ; notranslate” title=””>$ CID=$(docker run -d ubuntu echo “Hello”)$ echo $CID5594248e11b7d4d40cfec4737c7e4b7577fe1e665cf033439522fbf4f9c4e2d5$ sudo cat /var/lib/docker/containers/$CID/$CID-json.log{“log”:”Hellon”,”stream”:”stdout”,”time”:”2015-03-30T00:34:58.782658342Z”}</pre> What happened here? Our container simply outputs `Hello`. This output will go to the standard output of the container. By default, Docker will write the output wrapped into JSON into a specific file named after the container ID, in a directory under `/var/lib/docker/containers` named after the container ID. ### Logging the Container Output to Syslog With the new logging drivers capability, it is possible to select the logging behavior when running a container. In addition to the default `json-file` driver, there is now also a syslog driver supported. To see this in action, do this in one terminal window: <pre class=”brush: plain; title: ; notranslate” title=””>$ tail -F /var/log/syslog</pre> Then, in another terminal window, do this: <pre class=”brush: plain; title: ; notranslate” title=””>$ docker run -d –log-driver=syslog ubuntu echo “Hello”</pre> When running the container, you should see something along these lines in the tailed syslog file: ``` Mar 29 17:39:01 dev1 docker[116314]: 0e5b67244c00: Hello ``` Cool! Based on the `--log-driver` flag, which is set to `syslog` here, syslog received a message from the Docker daemon, which includes the container ID (well, the first 12 characters anyways), plus the actual output of the container. In this case of course, the output was just a simple message. To generate more messages, something like this will do the trick: <pre class=”brush: plain; title: ; notranslate” title=””>$ docker run -t -d –log-driver=syslog ubuntu /bin/bash -c ‘while true; do echo “Hello $(date)”; sleep 1; done'</pre> While still tailing the syslog file, a new log message should appear every minute. ### Completely Suppressing the Container Output Notably, when the logging driver is set to `syslog`, Docker sends the container output only to syslog, and not to file. This helps in managing disk space. Docker’s default behavior of writing container output to file can cause pain in managing disk space on the host. If a lot of containers are running on the host, and logging to standard out and standard error are used (as recommended for containerized apps) then some sort of space management for those files has to be bolted on, or the host eventually runs out of disk space. This is obviously not great. But now, there is also a `none` option for the logging driver, which will essentially dev-null the container output. <pre class=”brush: plain; title: ; notranslate” title=””>$ CID=$(docker run -d –log-driver=none ubuntu /bin/bash -c ‘while true; do echo “Hello”; sleep 1; done’)$ sudo cat /var/lib/docker/containers/$CID/$CID-json.logcat: /var/lib/docker/containers/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4/52c646fc0d284c6bbcad48d7b81132cb7ba03c04e9978244fdc4bcfcbf98c6e4-json.log: No such file or directory</pre> However, this will also disable the Logs API, so the [docker logs](https://docs.docker.com/reference/commandline/cli/#logs) CLI will also not work anymore, and neither will the [/logs API endpoint](http://docs.docker.com/reference/api/docker_remote_api_v1.17/#get-container-logs). This means that if you are using for example [Logspout](https://github.com/gliderlabs/logspout) to ship logs off the Docker host, you will still have to use the default `json-file` option. ### Integrating the Sumo Logic Collector With the New Syslog Logging Driver In a previous blog, we described how to use the Sumo Logic Collector images to get container logs to Sumo Logic. We have prepared an image that extends the framework developed in the [previous post](https://www.sumologic.com/2014/12/11/official-docker-image-sumo-logic-collector/). You can get all the logs into Sumo Logic by running with the `syslog` logging driver and running the Sumo Logic Collector on the host: <pre class=”brush: plain; title: ; notranslate” title=””>$ docker run -v /var/log/syslog:/syslog -d –name=”sumo-logic-collector” sumologic/collector:latest-logging-driver-syslog \[Access ID\] \[Access Key\]</pre> As a Sumo Logic user, it is very easy to generate the required access key by going to the [Preferences page](https://service.sumologic.com/help/Default.htm#Generating_Collector_Installation_API_Keys.htm). And that’s it folks. Select the `syslog` logging driver, and add the Sumo Logic Collector container to your hosts, and all the container logs will go into one place for analysis and troubleshooting. ### Article Tags - [Containers](https://www.sumologic.com/blog/containers) Christian Beedgen As co-founder and CTO of Sumo Logic, Christian Beedgen brings 18 years experience creating industry-leading enterprise software products. Since 2010 he has been focused on building Sumo Logic’s multi-tenant, cloud-native machine data analytics platform which is widely used today by more than 1,600 customers and 50,000 users. Prior to Sumo Logic, Christian was an early engineer, engineering director and chief architect at ArcSight, contributing to ArcSight’s SIEM and log management solutions. [](https://www.sumologic.com/feed "RSS Feed")[](https://twitter.com/intent/tweet?text=New%20Docker%20Logging%20Drivers&url=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fnew-docker-logging-drivers "X")[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fnew-docker-logging-drivers "Facebook")[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.sumologic.com%2Fblog%2Fnew-docker-logging-drivers "Linkedin") [Previous blog Collecting and Analyzing CoreOS (journald) Logs w/ Sumo Logic](https://www.sumologic.com/blog/collecting-journald-logs)[Next blog Collecting In-Container Log Files](https://www.sumologic.com/blog/collecting-in-container-log-files) People who read this also enjoyed [ Kubernetes vs Docker: How to choose the right container solution? July 8, 2025 ](https://www.sumologic.com/blog/kubernetes-vs-docker)[ From stateful to stateless: Sumo Logic’s transition from Lucene to Parquet-based architecture October 29, 2024 ](https://www.sumologic.com/blog/stateful-to-stateless-architecture)[ How to execute an Azure Cloud purple team exercise September 28, 2023 ](https://www.sumologic.com/blog/azure-cloud-purple-team)[ Learn how to use the common OpenTelemetry demo application with Sumo Logic January 26, 2023 ](https://www.sumologic.com/blog/common-opentelemetry-demo-application) [AI Instructions](https://www.sumologic.com/ai-instructions.md)