Chapter 74: DevOps Projects Part 4: Docker Scan, Network, Logging and Swarm
74.3 Project 29: Central container logging on one host
Friends, logs that stay only in a developer terminal vanish at 2 a.m. Today we use docker logs with timestamps and tail, set json-file rotation, write Compose logging options, and practice grepping errors.
मित्रांनो, फक्त terminal मध्ये राहिलेले logs रात्री 2 वाजता हरतात. आज docker logs -t --tail, json-file rotation, Compose logging options, error grep.
दोस्तों, सिर्फ terminal में रहे logs रात 2 बजे गायब हो जाते हैं. आज docker logs -t --tail, json-file rotation, Compose logging options, error grep.
What you will build in this project
- Chatty container with docker logs.
- Timestamps and follow.
- max-size / max-file rotation.
- Compose logging block.
1. Start from a real company story
At Policybazaar in Gurugram, a quote API filled the Docker host disk overnight because json-file had no max-size.
Nodes went read-only. Rough cost: about ₹7 lakh in overnight war-room and lost quotes.
Omar added max-size and max-file on every service and shipped copies to Loki.
Today we practice host-side logging hygiene.
Ravindra Bagale's Tip
Many students run docker logs -f on production hosts over SSH and leave the session open for hours. Prefer a shipper and a query UI. Keep that habit.
खूप students production वर docker logs -f उघडून तास बसतात. Shipper आणि query UI. सवय ठेवा.
बहुत students production पर docker logs -f खोल घंटों बैठते हैं. Shipper और query UI. आदत रखिए.
2. Start and prepare
Step 1: Run app that logs
Why: Need a noisy container. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: docker run logger. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 1: run
Type this:
docker rm -f log-app >/dev/null 2>&1; docker run -d --name log-app alpine:3.20 sh -c 'i=0; while true; do echo "INFO tick=$i"; i=$((i+1)); sleep 1; done' && echo started
You will see:
started
What it means: Logger.
Example 2: ps
Type this:
docker ps --filter name=log-app --format '{{.Names}} {{.Status}}'
You will see:
log-app Up ...
What it means: Up.
Example 3: wait
Type this:
sleep 2; echo warm
You will see:
warm
What it means: Ticks.
Step 2: docker logs basics
Why: logs is the first tool. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: docker logs. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 4: logs
Type this:
docker logs log-app 2>&1 | tail -5
You will see:
INFO tick=...
What it means: Lines.
Example 5: all tip
Type this:
echo 'docker logs log-app prints stdout and stderr of the main process'
You will see:
docker logs log-app prints stdout and stderr of the main process
What it means: Scope.
Example 6: since
Type this:
docker logs --since 10s log-app 2>&1 | wc -l
You will see:
~10
What it means: Recent.
Step 3: Follow and tail
Why: Follow for live debug. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: -f --tail. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 7: tail
Type this:
docker logs --tail 3 log-app
You will see:
INFO tick=...
What it means: Last 3.
Example 8: follow shape
Type this:
echo 'docker logs -f --tail 20 log-app'
You will see:
docker logs -f --tail 20 log-app
What it means: Follow.
Example 9: stop follow
Type this:
echo 'Ctrl-C leaves the container running'
You will see:
Ctrl-C leaves the container running
What it means: Note.
3. Build the main pieces
Step 4: Timestamps
Why: Timestamps order events. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: -t. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 10: ts
Type this:
docker logs -t --tail 2 log-app
You will see:
2026-... INFO tick=...
What it means: Timestamps.
Example 11: why
Type this:
echo 'Timestamps help match app logs to load balancer logs'
You will see:
Timestamps help match app logs to load balancer logs
What it means: Why.
Example 12: utc
Type this:
echo 'Docker timestamps are UTC; convert when you report to IST teams'
You will see:
Docker timestamps are UTC; convert when you report to IST teams
What it means: Zone.
Step 5: JSON file driver tip
Why: JSON file is the default driver. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: log-driver json-file. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 13: inspect
Type this:
docker inspect -f '{{.HostConfig.LogConfig.Type}}' log-app
You will see:
json-file
What it means: Default driver.
Example 14: path tip
Type this:
echo 'On Linux json-file lands under /var/lib/docker/containers/<id>/<id>-json.log'
You will see:
On Linux json-file lands under /var/lib/docker/containers/<id>/<id>-json.log
What it means: Path.
Example 15: why json
Type this:
echo 'JSON file is fine for single hosts; ship out for fleets'
You will see:
JSON file is fine for single hosts; ship out for fleets
What it means: Limit.
Step 6: Tag labels
Why: Labels find streams. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: --log-opt tag. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 16: retag
Type this:
docker rm -f log-app >/dev/null; docker run -d --name log-app --log-opt tag='shop/{{.Name}}' alpine:3.20 sh -c 'while true; do echo ERROR boom; sleep 2; done' && echo tagged
You will see:
tagged
What it means: Tag opt.
Example 17: cfg
Type this:
docker inspect -f '{{json .HostConfig.LogConfig}}' log-app
You will see:
{"Type":"json-file","Config":{"tag":"shop/{{.Name}}"}}
What it means: Config.
Example 18: why tag
Type this:
echo 'Tags make downstream filters easier'
You will see:
Tags make downstream filters easier
What it means: Why.
4. Automate and verify
Step 7: Run fluent-bit shape
Why: Fluent Bit ships out. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: fluent/fluent-bit. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 19: fb shape
Type this:
echo 'docker run -d --name fluent-bit -v /var/lib/docker/containers:/var/lib/docker/containers:ro fluent/fluent-bit:3.0'
You will see:
docker run -d --name fluent-bit -v /var/lib/docker/containers:/var/lib/docker/containers:ro fluent/fluent-bit:3.0
What it means: Shipper shape.
Example 20: why
Type this:
echo 'Fluent Bit tails container logs and forwards to Loki or Elasticsearch'
You will see:
Fluent Bit tails container logs and forwards to Loki or Elasticsearch
What it means: Role.
Example 21: lab
Type this:
echo 'In this lab we keep json-file + grep; production adds a shipper'
You will see:
In this lab we keep json-file + grep; production adds a shipper
What it means: Honest.
Step 8: Ship to file
Why: File sink for labs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: output file. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 22: file sink tip
Type this:
echo 'For a quick lab sink: redirect docker logs to a file with a cron or a script'
You will see:
For a quick lab sink: redirect docker logs to a file with a cron or a script
What it means: Sink.
Example 23: sample
Type this:
docker logs --tail 20 log-app > /tmp/log-app.out 2>&1 && wc -l /tmp/log-app.out
You will see:
~10 /tmp/log-app.out
What it means: Saved.
Example 24: cat
Type this:
tail -3 /tmp/log-app.out
You will see:
ERROR boom
What it means: Content.
Step 9: Compose logging options
Why: Compose sets drivers. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: logging: in compose. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 25: compose
Type this:
printf '%s\n' 'services:' ' app:' ' image: alpine:3.20' ' command: ["sh","-c","while true; do echo hi; sleep 2; done"]' ' logging:' ' driver: json-file' ' options:' ' max-size: "10m"' ' max-file: "3"' > /tmp/log-compose.yaml && cat /tmp/log-compose.yaml
You will see:
services... max-size 10m
What it means: Compose logging.
Example 26: why
Type this:
echo 'Set max-size in every Compose service that runs for days'
You will see:
Set max-size in every Compose service that runs for days
What it means: Habit.
Example 27: mode
Type this:
stat -c '%a' /tmp/log-compose.yaml
You will see:
644
What it means: Safe.
5. Harden and accept
Step 10: Rotate to save disk
Why: Unbounded logs fill disks. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: max-size max-file. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 28: recreate
Type this:
docker rm -f log-app >/dev/null; docker run -d --name log-app --log-opt max-size=1m --log-opt max-file=2 alpine:3.20 sh -c 'while true; do echo INFO padpadpadpad; sleep 0.2; done' && echo rotating
You will see:
rotating
What it means: Rotate opts.
Example 29: cfg
Type this:
docker inspect -f '{{json .HostConfig.LogConfig.Config}}' log-app
You will see:
{"max-file":"2","max-size":"1m"}
What it means: Opts.
Example 30: disk tip
Type this:
echo 'Without rotation, a chatty container can fill the Docker host disk'
You will see:
Without rotation, a chatty container can fill the Docker host disk
What it means: Risk.
Step 11: grep errors
Why: grep finds the fault. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: docker logs 2>&1 | grep. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 31: grep
Type this:
docker logs log-app 2>&1 | grep ERROR | tail -3 || echo 'no_ERROR_yet'
You will see:
ERROR boom / no_ERROR_yet
What it means: Filter.
Example 32: count
Type this:
docker logs log-app 2>&1 | grep -c INFO | head -1
You will see:
N
What it means: Count.
Example 33: pipe
Type this:
echo 'In production, ship then query in Loki or CloudWatch instead of grepping hosts'
You will see:
In production, ship then query in Loki or CloudWatch instead of grepping hosts
What it means: Prod.
Step 12: Acceptance checklist
Why: Omar signs off when logs rotate and greps work. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if logging and the swarm are healthy today.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams centralize logs and roll out services.
Example 34: rotate set
Type this:
docker inspect -f '{{.HostConfig.LogConfig.Config}}' log-app
You will see:
map[max-file:2 max-size:1m]
What it means: Proof.
Example 35: sample file
Type this:
test -f /tmp/log-app.out && echo file_ok
You will see:
file_ok
What it means: File.
Example 36: Sign-off
Type this:
echo 'Omar: PASS'
You will see:
Omar: PASS
What it means: Done.
Check yourself
Q1. Who fixed Policybazaar disk fill?
Omar
Q2. Default log driver?
json-file
Q3. Rotate keys?
max-size max-file
Q4. Follow flag?
-f
Q5. Timestamp flag?
-t
Q6. Prod query idea?
Loki or CloudWatch
Friends, you set rotation and grepped container logs. Did you understand? Let us try it once more. Add the Compose logging block to the WordPress lab next.
मित्रांनो, तुम्ही rotation सेट करून container logs grep केले. पुढे WordPress lab मध्ये Compose logging block टाका.
दोस्तों, आपने rotation सेट कर container logs grep किए. आगे WordPress lab में Compose logging block डालें.
Lab: try at home
- Run a chatty alpine logger.
- docker logs -t --tail.
- Recreate with max-size.
- Write Compose logging options.
- grep ERROR.
Recap
- json-file is the default.
- Always set max-size.
- Timestamps are UTC.
- Compose can set the same opts.
- Ship for multi-host fleets.