Collect logs from standard Docker containers

Step 1: Deploy a Logtail container

1. Run the following command to pull the Logtail image:

   docker pull registry.cn-hangzhou.aliyuncs.com/log-service/logtail

   Replace registry.cn-hangzhou.aliyuncs.com with the actual value. For more information about regions, see Table 1. If your server is in a virtual private cloud (VPC), you must replace registry with registry-vpc.

2. Start a Logtail container.
   Note Before you set the parameters, you must complete one of the following configurations. Otherwise, the container text file busy error may occur when you delete other containers.

   • For CentOS 7.4 and later, set fs.may_detach_mounts to 1. For more information, see Bug 1468249, Bug 1441737, and Issue 34538.
   • Add --privileged to the startup parameters to grant Logtail the privileged permission. For more information, see Docker run reference.

   Replace the ${your_region_name}, ${your_aliyun_user_id}, and ${your_machine_group_user_defined_id} parameters in the following command with the actual values:

   docker run -d -v /:/logtail_host:ro -v /var/run:/var/run --env ALIYUN_LOGTAIL_CONFIG=/etc/ilogtail/conf/${your_region_name}/ilogtail_config.json --env ALIYUN_LOGTAIL_USER_ID=${your_aliyun_user_id} --env ALIYUN_LOGTAIL_USER_DEFINED_ID=${your_machine_group_user_defined_id} registry.cn-hangzhou.aliyuncs.com/log-service/logtail

   Parameter	Description
   ${your_region_name}	The ID of the region where your project resides and the type of the network that your project uses. For more information about regions, see Table 1. If your project uses the Internet, set the value in the region-internet format, for example, cn-hangzhou-internet. If your project uses the Alibaba Cloud internal network, set the value in the region format, for example, cn-hangzhou.
   ${your_aliyun_user_id}	The ID of your Alibaba Cloud account. For more information, see Configure an account ID for a server.
   ${your_machine_group_user_defined_id}	The custom identifier of your server group. The identifier must be unique in the region where your project resides. For more information, see Create a custom ID-based machine group.

   Note

   You can customize the startup parameters of the Logtail container if the following conditions are met:

   1. The following environment variables are configured: ALIYUN_LOGTAIL_USER_DEFINED_ID, ALIYUN_LOGTAIL_USER_ID, and ALIYUN_LOGTAIL_CONFIG.
   2. The /var/run directory of the host is mounted on the /var/run directory of the Logtail container.
   3. The root directory of the host is mounted on the /logtail_host directory of the Logtail container.
   4. If the The parameter is invalid : uuid=none error is returned in the /usr/local/ilogtail/ilogtail.LOG log file, you must create a file named product_uuid on the host. Then, you must enter a valid UUID in the file, for example, 169E98C9-ABC0-4A92-B1D2-AA6239C0D261, and mount the file on the /sys/class/dmi/id/product_uuid directory of the Logtail container.

Step 2: Create a Logtail configuration file

Create a Logtail configuration file in the console based on your business requirements.

• To collect Docker text logs, follow the steps that you perform to collect Kubernetes text logs. For more information, see Use the console to collect Kubernetes text logs in DaemonSet mode.
• To collect Docker stdout and stderr logs, follow the steps that you perform to collect Kubernetes stdout and stderr logs. For more information, see Use the console to collect Kubernetes stdout and stderr logs in DaemonSet mode.
• To collect host text logs, follow the steps provided in Collect text logs.

  By default, the root directory of the host is mounted on the /logtail_host directory of the Logtail container. When you configure the directory to collect logs, you must add the container directory as the prefix to the log path. For example, to collect logs from the /home/logs/app_log/ directory of the host, you must set the log path to /logtail_host/home/logs/app_log/.

When you create a server group, enter the value of the ALIYUN_LOGTAIL_USER_DEFINED_ID parameter in the Custom Identifier field. This value is specified in Step 1: Deploy a Logtail container.

Default fields

• Docker stdout and stderr logs
  The following table describes the fields that are uploaded by default for each log entry.

  Log field	Description
  _time_	The time when the data is uploaded, for example, 2018-02-02T02:18:41.979147844Z.
  _source_	The type of a data source. Valid values: stdout and stderr.
  _image_name_	The name of an image.
  _container_name_	The name of a container.
  _container_ip_	The IP address assigned to the pod where a container resides.

• Docker text logs
  The following table describes the fields that are uploaded by default for each log entry.

  Log field	Description
  _image_name_	The name of an image.
  _container_name_	The name of a container.
  _container_ip_	The IP address assigned to the pod where a container resides.

Related operations

• View the status of Logtail.

  You can run the docker exec ${logtail_container_id} /etc/init.d/ilogtaild status command to view the status of Logtail.

• View the version number, IP address, and startup time of Logtail.

  You can run the docker exec ${logtail_container_id} cat /usr/local/ilogtail/app_info.json command to view the information of Logtail.

• View the operational logs of Logtail.

  The operational logs of Logtail are stored in the ilogtail.LOG file in the /usr/local/ilogtail/ directory. If the log file is rotated and compressed, it is stored as a file named ilogtail.LOG.x.gz.

  Example:

  [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 tail -n 5 /usr/local/ilogtail/ilogtail.LOG
  [2018-02-06 08:13:35.721864]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:104]    logtail plugin Resume:start
  [2018-02-06 08:13:35.722135]    [INFO]    [8]    [build/release64/sls/ilogtail/LogtailPlugin.cpp:106]    logtail plugin Resume:success
  [2018-02-06 08:13:35.722149]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:369]    start add existed check point events, size:0
  [2018-02-06 08:13:35.722155]    [INFO]    [8]    [build/release64/sls/ilogtail/EventDispatcher.cpp:511]    add existed check point events, size:0    cache size:0    event size:0    success count:0
  [2018-02-06 08:13:39.725417]    [INFO]    [8]    [build/release64/sls/ilogtail/ConfigManager.cpp:3776]    check container path update flag:0    size:1

  The standard output of the container is irrelevant to this case. Ignore the following standard output:

  
  start umount useless mount points, /shm$|/merged$|/mqueue$
  umount: /logtail_host/var/lib/docker/overlay2/3fd0043af174cb0273c3c7869500fbe2bdb95d13b1e110172ef57fe840c82155/merged: must be superuser to unmount
  umount: /logtail_host/var/lib/docker/overlay2/d5b10aa19399992755de1f85d25009528daa749c1bf8c16edff44beab6e69718/merged: must be superuser to unmount
  umount: /logtail_host/var/lib/docker/overlay2/5c3125daddacedec29df72ad0c52fac800cd56c6e880dc4e8a640b1e16c22dbe/merged: must be superuser to unmount
  ......
  xargs: umount: exited with status 255; aborting
  umount done
  start logtail
  ilogtail is running
  logtail status:
  ilogtail is running

• Restart Logtail.

  To restart Logtail, use the following sample code:

  [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild stop
  kill process Name: ilogtail pid: 7
  kill process Name: ilogtail pid: 8
  stop success
  [root@iZbp17enxc2us3624wexh2Z ilogtail]# docker exec a287de895e40 /etc/init.d/ilogtaild start
  ilogtail is running