Table of contents
You can use the docker logs command to read container logs regardless of theconfigured logging driver or plugin. Docker Engine uses thelocallogging driver to act as cache for reading the latest logs of your containers.This is called dual logging. By default, the cache has log-file rotationenabled, and is limited to a maximum of 5 files of 20 MB each (beforecompression) per container.
Refer to theconfiguration options section to customizethese defaults, or to thedisable dual loggingsection to disable this feature.
Prerequisites
Docker Engine automatically enables dual logging if the configured loggingdriver doesn't support reading logs.
The following examples show the result of running a docker logs command withand without dual logging availability:
Without dual logging capability
When a container is configured with a remote logging driver such as splunk, anddual logging is disabled, an error is displayed when attempting to read containerlogs locally:
Step 1: Configure Docker daemon
$ cat /etc/docker/daemon.json{ "log-driver": "splunk", "log-opts": { "cache-disabled": "true", ... (options for "splunk" logging driver) }}Step 2: Start the container
$ docker run -d busybox --name testlog topStep 3: Read the container logs
$ docker logs 7d6ac83a89a0Error response from daemon: configured logging driver does not support reading
With dual logging capability
With the dual logging cache enabled, the docker logs command can be used toread logs, even if the logging driver doesn't support reading logs. The followingexample shows a daemon configuration that uses the splunk remote logging driveras a default, with dual logging caching enabled:
Step 1: Configure Docker daemon
$ cat /etc/docker/daemon.json{ "log-driver": "splunk", "log-opts": { ... (options for "splunk" logging driver) }}Step 2: Start the container
$ docker run -d busybox --name testlog topStep 3: Read the container logs
$ docker logs 7d6ac83a89a02019-02-04T19:48:15.423Z [INFO] core: marked as sealed2019-02-04T19:48:15.423Z [INFO] core: pre-seal teardown starting2019-02-04T19:48:15.423Z [INFO] core: stopping cluster listeners2019-02-04T19:48:15.423Z [INFO] core: shutting down forwarding rpc listeners2019-02-04T19:48:15.423Z [INFO] core: forwarding rpc listeners stopped2019-02-04T19:48:15.599Z [INFO] core: rpc listeners successfully shut down2019-02-04T19:48:15.599Z [INFO] core: cluster listeners successfully shut down
Note
For logging drivers that support reading logs, such as the
local,json-fileandjournalddrivers, there is no difference in functionality before or afterthe dual logging capability became available. For these drivers, Logs can beread usingdocker logsin both scenarios.
Configuration options
The dual logging cache accepts the same configuration options as thelocal logging driver, but with a cache- prefix. These optionscan be specified per container, and defaults for new containers can be set usingthedaemon configuration file.
By default, the cache has log-file rotation enabled, and is limited to a maximumof 5 files of 20MB each (before compression) per container. Use the configurationoptions described below to customize these defaults.
| Option | Default | Description |
|---|---|---|
cache-disabled | "false" | Disable local caching. Boolean value passed as a string (true, 1, 0, or false). |
cache-max-size | "20m" | The maximum size of the cache before it is rotated. A positive integer plus a modifier representing the unit of measure (k, m, or g). |
cache-max-file | "5" | The maximum number of cache files that can be present. If rotating the logs creates excess files, the oldest file is removed. A positive integer. |
cache-compress | "true" | Enable or disable compression of rotated log files. Boolean value passed as a string (true, 1, 0, or false). |
Use the cache-disabled option to disable the dual logging cache. Disabling thecache can be useful to save storage space in situations where logs are only readthrough a remote logging system, and if there is no need to read logs throughdocker logs for debugging purposes.
Caching can be disabled for individual containers or by default for new containers,when using thedaemon configuration file.
The following example uses the daemon configuration file to use thesplunklogging driver as a default, with caching disabled:
$ cat /etc/docker/daemon.json{ "log-driver": "splunk", "log-opts": { "cache-disabled": "true", ... (options for "splunk" logging driver) }}Note
For logging drivers that support reading logs, such as the
local,json-fileandjournalddrivers, dual logging isn't used, and disabling the option hasno effect.
Limitations
- If a container using a logging driver or plugin that sends logs remotelyhas a network issue, no
writeto the local cache occurs. - If a write to
logdriverfails for any reason (file system full, writepermissions removed), the cache write fails and is logged in the daemon log.The log entry to the cache isn't retried. - Some logs might be lost from the cache in the default configuration because aring buffer is used to prevent blocking the stdio of the container in case ofslow file writes. An admin must repair these while the daemon is shut down.
