All Products
Search
Document Center

Simple Log Service:Collect logs from standard Docker containers

Last Updated:Aug 02, 2023

This topic describes how to deploy a Logtail container and create a Logtail configuration to collect logs from standard Docker containers. The logs include text logs, and standard output (stdout) and standard error (stderr).

Prerequisites

  • A project and a Logstore are created. For more information, see Create a project and Create a Logstore.
  • The container from which you want to collect logs continuously generates logs.

    Important

    Logtail collects only incremental logs. If a log file on a server is not updated after the applied Logtail configuration is delivered to the server, Logtail does not collect logs from the file. For more information, see Read log files.

Step 1: Deploy a Logtail container

  1. Run the following command to pull the Logtail image:

    docker pull registry.cn-hangzhou.aliyuncs.com/log-service/logtail

    Replace registry.cn-hangzhou.aliyuncs.com based on your business scenario. For information about regions, see Region names for Logtail installation.

    Note

    If your server resides in a virtual private cloud (VPC), you must replace registry with registry-vpc.

  2. Start a Logtail container.

    Important

    Before you configure the parameters, you must complete one of the following configurations. Otherwise, the container text file busy error may occur when you delete other containers.

    • For CentOS 7.4 or later except CentOS 8.0, set the fs.may_detach_mounts parameter to 1. For more information, see Bug 1468249, Bug 1441737, and Issue 34538.

    • Add --privileged to the startup parameters to grant Logtail the privileged permission. For more information, see Docker run reference.

    Replace the ${your_region_name}, ${your_aliyun_user_id}, and ${your_machine_group_user_defined_id} parameters in the following command based on your business scenario:

    docker run -d -v /:/logtail_host:ro -v /var/run:/var/run --env ALIYUN_LOGTAIL_CONFIG=/etc/ilogtail/conf/${your_region_name}/ilogtail_config.json --env ALIYUN_LOGTAIL_USER_ID=${your_aliyun_user_id} --env ALIYUN_LOGTAIL_USER_DEFINED_ID=${your_machine_group_user_defined_id} registry.cn-hangzhou.aliyuncs.com/log-service/logtail

    Parameter

    Description

    ${your_region_name}

    The ID of the region where your project resides and the type of the network that your project uses. For more information about regions, see Region names for Logtail installation. For more information about network types, see Select a network type.

    • If your project uses the Internet, specify the value in the region-internet format. For example, if your project resides in the China (Hangzhou) region, set the parameter to cn-hangzhou-internet.

    • If your project uses an Alibaba Cloud internal network, specify the value in the region format. For example, if your project resides in the China (Hangzhou) region, set the parameter to cn-hangzhou.

    ${your_aliyun_user_id}

    The ID of the Alibaba Cloud account for which Simple Log Service is activated. For more information, see Obtain the ID of the Alibaba Cloud account for which Simple Log Service is activated.

    ${your_machine_group_user_defined_id}

    The custom identifier of your machine group. Example: log-docker-demo.

    Important
    • The identifier must be unique in the region where your project resides.

    • When you create a machine group in Step 2, you must enter the custom identifier that you specified in the current step in the Custom ID field.

    Important

    You can customize the startup parameters of the Logtail container only if the following conditions are met:

    • The following environment variables are configured: ALIYUN_LOGTAIL_USER_DEFINED_ID, ALIYUN_LOGTAIL_USER_ID, and ALIYUN_LOGTAIL_CONFIG.

    • The /var/run directory of the host is mounted on the /var/run directory of the Logtail container.

    • The root directory of the host is mounted on the /logtail_host directory of the Logtail container.

    • If the The parameter is invalid : uuid=none error is returned in the /usr/local/ilogtail/ilogtail.LOG log file, you must create a file named product_uuid on the host. Then, you must enter a valid UUID in the file, for example, 169E98C9-ABC0-4A92-B1D2-AA6239C0D261, and mount the file on the /sys/class/dmi/id/product_uuid directory of the Logtail container.

Step 2: Create a Logtail configuration

Create a Logtail configuration in the Simple Log Service console based on your business requirements.

  • If you want to collect Docker text logs, perform the following steps: In the Import Data section, click the On-premises Open Source/Commercial Software tab. On this tab, click Docker File - Container. Then, configure data collection by following the steps that you perform to collect Kubernetes text logs. For more information, see Use the Simple Log Service console to collect container text logs in DaemonSet mode.

    Note
    • When you collect Docker text logs, you must select a collection mode based on your business requirements, such as Simple Mode, Simple Mode - Multi-line, Full Regex Mode, JSON Mode, Delimiter Mode, and NGINX Mode. Logtail parses logs based on the collection mode that you select. For example, if you want to collect multi-line logs, you can select Simple Mode - Multi-line or Full Regex Mode. If you want to collect JSON logs, you can select JSON Mode. For more information about collection modes, see Collection modes.

    • If the fixed collection modes cannot meet your requirements to parse logs, you can turn on Enable Plug-in Processing in the Logtail configuration and add Logtail plug-ins. For example, you can add data processing plug-ins to extract fields, extract log time, desensitize data, and filter logs. For more information, see Logtail plug-ins.

  • If you want to collect Docker stdout and stderr, perform the following steps: In the Import Data section, click the On-premises Open Source/Commercial Software tab. On this tab, click Docker Standard Output - Container. Then, configure data collection by following the steps that you perform to collect Kubernetes stdout and stderr. For more information, see Use the Simple Log Service console to collect container stdout and stderr in DaemonSet mode.

  • If you want to collect text logs from a host, perform the following steps: In the Import Data section, click the On-premises Open Source/Commercial Software tab. On this tab, select a data source that is related to text logs. Example: Regex - Text Log.

    The procedure for collecting host text logs is the same as the procedure for collecting server text logs. For more information, see Collect text logs.

    Important

    By default, the root directory of the host is mounted on the /logtail_host directory of the Logtail container. When you create a Logtail configuration, you must add the /logtail_host prefix to the log path. For example, if you want to collect logs from the /home/logs/app_log/ directory of the host, you must set the Log Path parameter to /logtail_host/home/logs/app_log/.

When you create a machine group, you must set the Identifier parameter to Custom ID and enter the value of the ALIYUN_LOGTAIL_USER_DEFINED_ID parameter in the Custom ID field. This value is specified in Step 1: Deploy a Logtail container. Create Machine Group

Default fields

  • Docker stdout and stderr

    The following table describes the fields that are included by default in each log.

    Log field

    Description

    _time_

    The time when data was uploaded. Example: 2018-02-02T02:18:41.979147844Z.

    _source_

    The type of the input source. Valid values: stdout and stderr.

    _image_name_

    The name of the image.

    _container_name_

    The name of the container.

    _container_ip_

    The IP address of the container.

  • Docker text logs

    The following table describes the fields that are included by default in each log.

    Log field

    Description

    _image_name_

    The name of the image.

    _container_name_

    The name of the container.

    _container_ip_

    The IP address of the container.

Related operations

  • View the status of Logtail.

    You can run the docker exec ${logtail_container_id} /etc/init.d/ilogtaild status command to view the status of Logtail.

  • View the version number, IP address, and startup time of Logtail.

    You can run the docker exec ${logtail_container_id} cat /usr/local/ilogtail/app_info.json command to view the information about Logtail.

  • View the operational logs of Logtail.

    The operational logs of Logtail are stored in the ilogtail.LOG file in the /usr/local/ilogtail/ directory. If the log file is rotated, the generated files are compressed and stored as ilogtail.LOG.x.gz. Example:

    [sudo@iZb****xh2Z ilogtail]# docker exec a287de895e40 tail -n 5 /usr/local/ilogtail/ilogtail.LOG
    [2018-02-06 08:13:35.721864]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:104]    logtail plugin Resume:start
    [2018-02-06 08:13:35.722135]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:106]    logtail plugin Resume:success
    [2018-02-06 08:13:35.722149]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:369]    start add existed check point events, size:0
    [2018-02-06 08:13:35.722155]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:511]    add existed check point events, size:0    cache size:0    event size:0    success count:0
    [2018-02-06 08:13:39.725417]    [INFO]    [8]    [build/release64/sls/ilogtail/ConfigManager.cpp:3776]    check container path update flag:0    size:1

    The stdout of the Logtail container is irrelevant to this case. Ignore the following stdout:

    
    start umount useless mount points, /shm$|/merged$|/mqueue$
    umount: /logtail_host/var/lib/docker/overlay2/3fd0043af174cb0273c3c7869500fbe2bdb95d13b1e110172ef57fe840c82155/merged: must be superuser to unmount
    umount: /logtail_host/var/lib/docker/overlay2/d5b10aa19399992755de1f85d25009528daa749c1bf8c16edff44beab6e69718/merged: must be superuser to unmount
    umount: /logtail_host/var/lib/docker/overlay2/5c3125daddacedec29df72ad0c52fac800cd56c6e880dc4e8a640b1e16c22dbe/merged: must be superuser to unmount
    ......
    xargs: umount: exited with status 255; aborting
    umount done
    start logtail
    ilogtail is running
    logtail status:
    ilogtail is running
  • Restart Logtail.

    To restart Logtail, use the following sample code:

    [sudo@iZb****xh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild stop
    kill process Name: ilogtail pid: 7
    kill process Name: ilogtail pid: 8
    stop success
    [sudo@iZb****xh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild start
    ilogtail is running

Troubleshooting

For information about how to troubleshoot the errors that may occur when you use Logtail to collect Docker logs, see What do I do if an error occurs when I use Logtail to collect logs from containers?