Reading logs from Docker container can be done using
docker logs container_id. This simply fetches logs present at the time of execution from container’s STDOUT and STDERR streams. If you want to, however, transform those logs, and send them to a central repository using e.g. logstash, there are a number of options to choose from. Here I’ll be describing the simplest case of writing logs to /dev/log socket.
Writers will write
Minimalistic scenario for collecting logs expects that your software, running inside the Docker container, writes to a syslog using the Unix domain socket /dev/log. With a Ruby app running inside the Docker container you can use Syslog::Logger class like this:
With a nodejs app and some help of ain package you might end up with:
1 2 3 4
If you have a properly configured and running (r)syslog daemon, you will get to both accounts something like this in /var/log/messages:
And readers will read
Now comes the fun part. I promised to explain how this logging stuff and syslog plays with Docker. To be able to send logs to an IPC socket, somebody has to create it first. Let that somebody be an rsyslog daemon running on a Docker host. For this to work we need to have the following line in
Last thing yet to do is to bind mount /dev/log socket on Docker run using something like:
One important thing to notice is that once we restart rsyslog daemon, for whatever reason, all apps running inside the Docker containers won’t be able to write to syslog anymore. Reason for that is dead simple - the socket to which all apps were bound is now gone and replaced by another one. If we want to write logs to that new socket, we should probably restart our apps.