Logging Docker container output to individual files via Syslog

by Anastas Dancha

I'm not big on Rsyslog syntax, it's a bit overwhelming at first, though documentation is plentiful..

Here is how you can log Docker container output to individual files per container (using tags) via Syslog..

Add a template and a route to either main or individual rsyslog config (in my case /etc/rsyslog.d/10-docker.conf): 

# /etc/rsyslog.d/10-docker.conf
# Log Docker container logs to file per tag
$template DockerLogs, "/var/log/docker_%syslogtag:R,ERE,1,ZERO:.*docker/([^\[]+)--end%.log"
if $programname == 'docker' then -?DockerLogs  
& stop

Restart rsyslog and test your container output: 

root@test:~# service rsyslog restart  
root@test:~# docker run -it --rm --log-driver syslog --log-opt syslog-tag=java8u66b17-test1 anapsix/alpine-java java -version

Observe newly created log file (give it few seconds to get witten to disk): 

root@test:~# cat /var/log/docker_java8u66b17-test1.log  
Oct 28 15:50:47 test docker/java8u66b17-test1[2492]: java version "1.8.0_66"#015  
Oct 28 15:50:47 test docker/java8u66b17-test1[2492]: Java(TM) SE Runtime Environment (build 1.8.0_66-b17)#015  
Oct 28 15:50:47 test docker/java8u66b17-test1[2492]: Java HotSpot(TM) 64-Bit Server VM (build 25.66-b17, mixed mode)#015

As of Docker 1.9, tagging logs with --log-opt [syslog-tag/fluentd-tag/gelf-tag] will be replaced with simple --log-opt tag=blah. Using constructs such as {{.Name}}, {{.ID}}, {{.ImageName}} and similar will be possible as well.

For details see GitHub #15384

Reference

Docker Logging documentation: https://docs.docker.com/reference/logging/overview/

Rsyslog templates docs: http://www.rsyslog.com/doc/v8-stable/configuration/templates.html

Rsyslog property replacer docs: http://www.rsyslog.com/doc/v8-stable/configuration/property_replacer.html