Collect Docker events

Limits

• Logtail that runs on containers or hosts must be granted access to the /var/run/docker.sock file.

  For more information about how to use Logtail to collect Kubernetes logs, see Collect Kubernetes logs. For more information about how to collect standard container logs, see Collect logs from standard Docker containers.

• When Logtail is restarted or stopped, container events are not collected.

Scenarios

• Monitor the start and stop events of all containers, and trigger alerts when core containers stop running.
• Collect all container events for auditing, security analysis, and troubleshooting.
• Monitor all image pulling events, and trigger an alert if an image is pulled from an invalid path.

Procedure

1. Log on to the Log Service console.
2. In the Import Data section, select Custom Data Plug-in.
3. In the Specify Logstore step, select the target project and Logstore, and click Next.
   You can also click Create Now to create a project and a Logstore. For more information, see Step 1: Create a project and a Logstore.
4. In the Create Machine Group step, create a machine group.
   • If a machine group is available, click Using Existing Machine Groups.
   • If no machine group is available, perform the following steps. The following steps take ECS instances as an example to describe how to create a machine group:
     1. Install Logtail on ECS instances. For more information, see Install Logtail on ECS instances.

        If Logtail is installed on the ECS instances, click Complete Installation.

        Note If you want to collect logs from a user-created cluster, you must manually install Logtail on the servers in the cluster. For more information, see Install Logtail in Linux.
     2. After the installation is completed, click Complete Installation.
     3. On the page that appears, set relevant parameters for the machine group. For more information, see Create an IP address-based machine group or Create a custom ID-based machine group.
5. In the Machine Group Settings step, apply the configurations to the machine group.
   Select the created machine group and move the group from Source Server Groups to Applied Server Groups.
6. In the Specify Data Source step, set the Config Name and Plug-in Config parameters.
   • inputs: Required. The Logtail configurations for log collection.
     Note You can configure only one type of data source in the inputs field.
   • processors: Optional. The Logtail configurations for data processing. You can configure one or more processing methods in the processors field. For more information, see Process data.

   {
     "inputs": [
       {
         "detail": {},
         "type": "service_docker_event"
       }
     ]
   }

   Parameter	Type	Required	Description
   type	String	Yes	The type of the data source. Set the value to service_docker_event.
   EventQueueSize	Int	No	The maximum number of events in the event queue. Default value: 10.

7. In the Configure Query and Analysis step, configure the indexes.
   Indexes are configured by default. You can re-configure the indexes based on your business requirements. For more information, see Enable and configure the index feature for a Logstore.

   Note

   • You must configure Full Text Index or Field Search. If you configure both of them, the settings of Field Search are applied.
   • If the data type of index is long or double, the Case Sensitive and Delimiter settings are unavailable.