This topic describes how to deploy a Logtail container and create a Logtail configuration file to collect logs from standard Docker containers.

Step 1: Deploy a Logtail container

  1. Run the following command to pull the Logtail image:
    docker pull registry.cn-hangzhou.aliyuncs.com/log-service/logtail
  2. Start a Logtail container.
    Note Before you configure parameters to start a Logtail container, you must complete either of the following configurations. Otherwise, the container text file busy error may be returned when you kill other containers.
    • Set fs.may_detach_mounts to 1 if you are running CentOS 7.4 or a later version. For more information, see Bug 1468249, Bug 1441737, and Issue 34538.
    • Add --privileged to the startup parameters to grant Logtail the privileged permission. For more information, see Docker run reference.

    Configure the ${your_region_name}, ${your_aliyun_user_id}, and ${your_machine_group_user_defined_id} parameters in the following command based on your business needs.

    docker run -d -v /:/logtail_host:ro -v /var/run:/var/run --env 
    ALIYUN_LOGTAIL_CONFIG=/etc/ilogtail/conf/${your_region_name}/ilogtail_config.json 
    --env ALIYUN_LOGTAIL_USER_ID=${your_aliyun_user_id} --env
     ALIYUN_LOGTAIL_USER_DEFINED_ID=${your_machine_group_user_defined_id} registry.cn-hangzhou.aliyuncs.com/log-service/logtail
    Parameter Description
    ${your_region_name} The ID of the region and the type of the network where your project resides. For more information, see Table 1.
    • If your project resides in the public network, the parameter value is formatted in region-internet, for example, cn-hangzhou-Internet.
    • If your project resides in an internal network, the parameter value is formatted in region, for example, cn-hangzhou.
    ${your_aliyun_user_id} The unique ID of your Alibaba Cloud account. For more information, see Figure 1.
    ${your_machine_group_user_defined_id} The custom identifier of your server group. The identifier must be unique in the region where your project resides. For more information, see Create a server group with a custom identifier.
    Note

    You can customize the startup parameters of the Logtail container if the following conditions are met:

    1. The following environment variables are configured: ALIYUN_LOGTAIL_USER_DEFINED_ID, ALIYUN_LOGTAIL_USER_ID, and ALIYUN_LOGTAIL_CONFIG.
    2. The /var/run directory of the host is mounted on the /var/run directory of the Logtail container.
    3. The host root directory is mounted on the /logtail_host directory of the Logtail container.
    4. If the The parameter is invalid : uuid=none error is returned in the /usr/local/ilogtail/ilogtail.LOG log file, you must create a file named product_uuid on the host. Then, you must enter a valid UUID (for example, 169E98C9-ABC0-4A92-B1D2-AA6239C0D261) in the file and mount the file on the /sys/class/dmi/id/product_uuid directory of the Logtail container.

Step 2: Create a collection configuration file

Configure log collection in the console based on your needs.

  • To collect Docker text logs, follow the same steps as when you collect Kubernetes text logs. For more information, see Use the console to collect Kubernetes text logs in the DaemonSet mode.
  • To collect Docker stdout and stderr logs, follow the same steps as when you collect Kubernetes stdout and stderr logs. For more information, Use the console to collect Kubernetes stdout and stderr logs in the DaemonSet mode.
  • To collect host text logs, follow the steps provided in Collect text logs.

    The host root directory is mounted on the /logtail_host directory of the Logtail container by default. You must add the container directory as the prefix to the log path when you configure log collection. For example, if you want to collect data from the /home/logs/app_log/ directory of the host, you must set the log path to /logtail_host/home/logs/app_log/.

When you create a server group, enter in the field ALIYUN_LOGTAIL_USER_DEFINED_ID that you configured in .Configure a server group

Default fields

  • Collect Docker stdout and stderr logs
    The following table lists the fields that are uploaded by default for each log entry.
    Field name Description
    _time_ The data upload time, for example, 2018-02-02T02:18:41.979147844Z.
    _source_ The type of input data sources. Valid values: stdout and stderr.
    _image_name_ The name of an image.
    _container_name_ The name of a container.
    _container_ip_ The IP address assigned to the pod where a container resides.
  • Docker text logs
    The following table lists the fields that are uploaded by default for each log entry.
    Field name Description
    _image_name_ The name of an image.
    _container_name_ The name of a container.
    _container_ip_ The IP address assigned to the pod where a container resides.

What to do next

  • View the running status of the Logtail container.

    You can run the docker exec ${logtail_container_id} /etc/init.d/ilogtaild status command to view the running status of Logtail.

  • View the version number, IP address, and startup time of Logtail.

    You can run the docker exec ${logtail_container_id} cat /usr/local/ilogtail/app_info.json command to view Logtail information.

  • View the operational logs of Logtail.

    The operational logs of Logtail are stored in the ilogtail.LOG file in the /usr/local/ilogtail/ directory. If the log file is rotated and compressed, it is stored as a file named ilogtail.LOG.x.gz.

    Example:
    [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 tail -n 5 /usr/local/ilogtail/ilogtail.LOG
    [2018-02-06 08:13:35.721864]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:104]    logtail plugin Resume:start
    [2018-02-06 08:13:35.722135]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:106]    logtail plugin Resume:success
    [2018-02-06 08:13:35.722149]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:369]    start add existed check point events, size:0
    [2018-02-06 08:13:35.722155]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:511]    add existed check point events, size:0    cache size:0    event size:0    success count:0
    [2018-02-06 08:13:39.725417]    [INFO]    [8]    [build/release64/sls/ilogtail/ConfigManager.cpp:3776]    check container path update flag:0    size:1
    The container standard output is insignificant. Ignore the following standard output:
    
    start umount useless mount points, /shm$|/merged$|/mqueue$
    umount: /logtail_host/var/lib/docker/overlay2/3fd0043af174cb0273c3c7869500fbe2bdb95d13b1e110172ef57fe840c82155/merged: must be superuser to unmount
    umount: /logtail_host/var/lib/docker/overlay2/d5b10aa19399992755de1f85d25009528daa749c1bf8c16edff44beab6e69718/merged: must be superuser to unmount
    umount: /logtail_host/var/lib/docker/overlay2/5c3125daddacedec29df72ad0c52fac800cd56c6e880dc4e8a640b1e16c22dbe/merged: must be superuser to unmount
    ...
    xargs: umount: exited with status 255; aborting
    umount done
    start logtail
    ilogtail is running
    logtail status:
    ilogtail is running
  • Restart Logtail.

    To restart Logtail, use the following sample code:

    [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild stop
    kill process Name: ilogtail pid: 7
    kill process Name: ilogtail pid: 8
    stop success
    [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild start
    ilogtail is running