github.com/portworx/docker@v1.12.1/docs/admin/logging/overview.md (about) 1 <!--[metadata]> 2 +++ 3 aliases = ["/engine/reference/logging/overview/"] 4 title = "Configuring Logging Drivers" 5 description = "Configure logging driver." 6 keywords = ["docker, logging, driver, Fluentd"] 7 [menu.main] 8 parent = "smn_logging" 9 weight=-99 10 +++ 11 <![end-metadata]--> 12 13 14 # Configure logging drivers 15 16 The container can have a different logging driver than the Docker daemon. Use 17 the `--log-driver=VALUE` with the `docker run` command to configure the 18 container's logging driver. If the `--log-driver` option is not set, docker 19 uses the default (`json-file`) logging driver. The following options are 20 supported: 21 22 | Driver | Description | 23 |-------------|-------------------------------------------------------------------------------------------------------------------------------| 24 | `none` | Disables any logging for the container. `docker logs` won't be available with this driver. | 25 | `json-file` | Default logging driver for Docker. Writes JSON messages to file. | 26 | `syslog` | Syslog logging driver for Docker. Writes log messages to syslog. | 27 | `journald` | Journald logging driver for Docker. Writes log messages to `journald`. | 28 | `gelf` | Graylog Extended Log Format (GELF) logging driver for Docker. Writes log messages to a GELF endpoint like Graylog or Logstash. | 29 | `fluentd` | Fluentd logging driver for Docker. Writes log messages to `fluentd` (forward input). | 30 | `awslogs` | Amazon CloudWatch Logs logging driver for Docker. Writes log messages to Amazon CloudWatch Logs. | 31 | `splunk` | Splunk logging driver for Docker. Writes log messages to `splunk` using HTTP Event Collector. | 32 | `etwlogs` | ETW logging driver for Docker on Windows. Writes log messages as ETW events. | 33 | `gcplogs` | Google Cloud Logging driver for Docker. Writes log messages to Google Cloud Logging. | 34 35 The `docker logs`command is available only for the `json-file` and `journald` 36 logging drivers. 37 38 The `labels` and `env` options add additional attributes for use with logging 39 drivers that accept them. Each option takes a comma-separated list of keys. If 40 there is collision between `label` and `env` keys, the value of the `env` takes 41 precedence. 42 43 To use attributes, specify them when you start the Docker daemon. For example, 44 to manually start the daemon with the `json-file` driver, and include additional 45 attributes in the output, run the following command: 46 47 ```bash 48 $ docker daemon \ 49 --log-driver=json-file \ 50 --log-opt labels=foo \ 51 --log-opt env=foo,fizz 52 ``` 53 54 Then, run a container and specify values for the `labels` or `env`. For 55 example, you might use this: 56 57 ```bash 58 $ docker run -dit --label foo=bar -e fizz=buzz alpine sh 59 ``` 60 61 This adds additional fields to the log depending on the driver, e.g. for 62 `json-file` that looks like: 63 64 ```json 65 "attrs":{"fizz":"buzz","foo":"bar"} 66 ``` 67 68 69 ## json-file options 70 71 The following logging options are supported for the `json-file` logging driver: 72 73 ```bash 74 --log-opt max-size=[0-9+][k|m|g] 75 --log-opt max-file=[0-9+] 76 --log-opt labels=label1,label2 77 --log-opt env=env1,env2 78 ``` 79 80 Logs that reach `max-size` are rolled over. You can set the size in 81 kilobytes(k), megabytes(m), or gigabytes(g). eg `--log-opt max-size=50m`. If 82 `max-size` is not set, then logs are not rolled over. 83 84 `max-file` specifies the maximum number of files that a log is rolled over 85 before being discarded. eg `--log-opt max-file=100`. If `max-size` is not set, 86 then `max-file` is not honored. 87 88 If `max-size` and `max-file` are set, `docker logs` only returns the log lines 89 from the newest log file. 90 91 92 ## syslog options 93 94 The following logging options are supported for the `syslog` logging driver: 95 96 ```bash 97 --log-opt syslog-address=[tcp|udp|tcp+tls]://host:port 98 --log-opt syslog-address=unix://path 99 --log-opt syslog-address=unixgram://path 100 --log-opt syslog-facility=daemon 101 --log-opt syslog-tls-ca-cert=/etc/ca-certificates/custom/ca.pem 102 --log-opt syslog-tls-cert=/etc/ca-certificates/custom/cert.pem 103 --log-opt syslog-tls-key=/etc/ca-certificates/custom/key.pem 104 --log-opt syslog-tls-skip-verify=true 105 --log-opt tag="mailer" 106 --log-opt syslog-format=[rfc5424|rfc5424micro|rfc3164] 107 --log-opt env=ENV1,ENV2,ENV3 108 --log-opt labels=label1,label2,label3 109 ``` 110 111 `syslog-address` specifies the remote syslog server address where the driver 112 connects to. If not specified it defaults to the local unix socket of the 113 running system. If transport is either `tcp` or `udp` and `port` is not 114 specified it defaults to `514` The following example shows how to have the 115 `syslog` driver connect to a `syslog` remote server at `192.168.0.42` on port 116 `123` 117 118 ```bash 119 $ docker run --log-driver=syslog --log-opt syslog-address=tcp://192.168.0.42:123 120 ``` 121 122 The `syslog-facility` option configures the syslog facility. By default, the 123 system uses the `daemon` value. To override this behavior, you can provide an 124 integer of 0 to 23 or any of the following named facilities: 125 126 * `kern` 127 * `user` 128 * `mail` 129 * `daemon` 130 * `auth` 131 * `syslog` 132 * `lpr` 133 * `news` 134 * `uucp` 135 * `cron` 136 * `authpriv` 137 * `ftp` 138 * `local0` 139 * `local1` 140 * `local2` 141 * `local3` 142 * `local4` 143 * `local5` 144 * `local6` 145 * `local7` 146 147 `syslog-tls-ca-cert` specifies the absolute path to the trust certificates 148 signed by the CA. This option is ignored if the address protocol is not 149 `tcp+tls`. 150 151 `syslog-tls-cert` specifies the absolute path to the TLS certificate file. This 152 option is ignored if the address protocol is not `tcp+tls`. 153 154 `syslog-tls-key` specifies the absolute path to the TLS key file. This option 155 is ignored if the address protocol is not `tcp+tls`. 156 157 `syslog-tls-skip-verify` configures the TLS verification. This verification is 158 enabled by default, but it can be overridden by setting this option to `true`. 159 This option is ignored if the address protocol is not `tcp+tls`. 160 161 `tag` configures a string that is appended to the APP-NAME in the syslog 162 message. By default, Docker uses the first 12 characters of the container ID to 163 tag log messages. Refer to the [log tag option documentation](log_tags.md) for 164 customizing the log tag format. 165 166 `syslog-format` specifies syslog message format to use when logging. If not 167 specified it defaults to the local unix syslog format without hostname 168 specification. Specify rfc3164 to perform logging in RFC-3164 compatible 169 format. Specify rfc5424 to perform logging in RFC-5424 compatible format. 170 Specify rfc5424micro to perform logging in RFC-5424 compatible format with 171 microsecond timestamp resolution. 172 173 `env` is a comma-separated list of keys of environment variables. Used for 174 advanced [log tag options](log_tags.md). 175 176 `labels` is a comma-separated list of keys of labels. Used for advanced [log 177 tag options](log_tags.md). 178 179 ## journald options 180 181 The `journald` logging driver stores the container id in the journal's 182 `CONTAINER_ID` field. For detailed information on working with this logging 183 driver, see [the journald logging driver](journald.md) reference documentation. 184 185 ## GELF options 186 187 The GELF logging driver supports the following options: 188 189 ```bash 190 --log-opt gelf-address=udp://host:port 191 --log-opt tag="database" 192 --log-opt labels=label1,label2 193 --log-opt env=env1,env2 194 --log-opt gelf-compression-type=gzip 195 --log-opt gelf-compression-level=1 196 ``` 197 198 The `gelf-address` option specifies the remote GELF server address that the 199 driver connects to. Currently, only `udp` is supported as the transport and you 200 must specify a `port` value. The following example shows how to connect the 201 `gelf` driver to a GELF remote server at `192.168.0.42` on port `12201` 202 203 ```bash 204 $ docker run -dit \ 205 --log-driver=gelf \ 206 --log-opt gelf-address=udp://192.168.0.42:12201 \ 207 alpine sh 208 ``` 209 210 By default, Docker uses the first 12 characters of the container ID to tag log 211 messages. Refer to the [log tag option documentation](log_tags.md) for 212 customizing the log tag format. 213 214 The `labels` and `env` options are supported by the gelf logging 215 driver. It adds additional key on the `extra` fields, prefixed by an 216 underscore (`_`). 217 218 // […] 219 "_foo": "bar", 220 "_fizz": "buzz", 221 // […] 222 223 The `gelf-compression-type` option can be used to change how the GELF driver 224 compresses each log message. The accepted values are `gzip`, `zlib` and `none`. 225 `gzip` is chosen by default. 226 227 The `gelf-compression-level` option can be used to change the level of 228 compresssion when `gzip` or `zlib` is selected as `gelf-compression-type`. 229 Accepted value must be from from -1 to 9 (BestCompression). Higher levels 230 typically run slower but compress more. Default value is 1 (BestSpeed). 231 232 ## Fluentd options 233 234 You can use the `--log-opt NAME=VALUE` flag to specify these additional Fluentd 235 logging driver options. 236 237 - `fluentd-address`: specify `host:port` to connect [localhost:24224] 238 - `tag`: specify tag for `fluentd` message 239 - `fluentd-buffer-limit`: specify the maximum size of the fluentd log buffer [8MB] 240 - `fluentd-retry-wait`: initial delay before a connection retry (after which it increases exponentially) [1000ms] 241 - `fluentd-max-retries`: maximum number of connection retries before abrupt failure of docker [1073741824] 242 - `fluentd-async-connect`: whether to block on initial connection or not [false] 243 244 For example, to specify both additional options: 245 246 ```bash 247 $ docker run -dit \ 248 --log-driver=fluentd \ 249 --log-opt fluentd-address=localhost:24224 \ 250 --log-opt tag="docker.{{.Name}}" \ 251 alpine sh 252 ``` 253 254 If container cannot connect to the Fluentd daemon on the specified address and 255 `fluentd-async-connect` is not enabled, the container stops immediately. 256 For detailed information on working with this logging driver, 257 see [the fluentd logging driver](fluentd.md) 258 259 260 ## Amazon CloudWatch Logs options 261 262 The Amazon CloudWatch Logs logging driver supports the following options: 263 264 ```bash 265 --log-opt awslogs-region=<aws_region> 266 --log-opt awslogs-group=<log_group_name> 267 --log-opt awslogs-stream=<log_stream_name> 268 ``` 269 270 For detailed information on working with this logging driver, see [the awslogs 271 logging driver](awslogs.md) reference documentation. 272 273 ## Splunk options 274 275 The Splunk logging driver requires the following options: 276 277 ```bash 278 --log-opt splunk-token=<splunk_http_event_collector_token> 279 --log-opt splunk-url=https://your_splunk_instance:8088 280 ``` 281 282 For detailed information about working with this logging driver, see the 283 [Splunk logging driver](splunk.md) reference documentation. 284 285 ## ETW logging driver options 286 287 The etwlogs logging driver does not require any options to be specified. This 288 logging driver forwards each log message as an ETW event. An ETW listener 289 can then be created to listen for these events. 290 291 The ETW logging driver is only available on Windows. For detailed information 292 on working with this logging driver, see [the ETW logging driver](etwlogs.md) 293 reference documentation. 294 295 ## Google Cloud Logging options 296 297 The Google Cloud Logging driver supports the following options: 298 299 ```bash 300 --log-opt gcp-project=<gcp_projext> 301 --log-opt labels=<label1>,<label2> 302 --log-opt env=<envvar1>,<envvar2> 303 --log-opt log-cmd=true 304 ``` 305 306 For detailed information about working with this logging driver, see the 307 [Google Cloud Logging driver](gcplogs.md). reference documentation.