Syslog logging driver

Estimated reading time: 5 minutes

The syslog logging driver routes logs to a syslog server. The syslog protocol uses a raw string as the log message and supports a limited set of metadata. The syslog message must be formatted in a specific way to be valid. From a valid message, the receiver can extract the following information:

• priority: the logging level, such as debug, warning, error, info.
• timestamp: when the event occurred.
• hostname: where the event happened.
• facility: which subsystem logged the message, such as mail or kernel.
• process name and process ID (PID): The name and ID of the process that generated the log.

The format is defined in RFC 5424 and Docker’s syslog driver implements the ABNF reference in the following way:

                TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID
                    +          +             +           |        +
                    |          |             |           |        |
                    |          |             |           |        |
       +------------+          +----+        |           +----+   +---------+
       v                            v        v                v             v
2017-04-01T17:41:05.616647+08:00 a.vm {taskid:aa,version:} 1787791 {taskid:aa,version:}

Usage

To use the syslog driver as the default logging driver, set the log-driver and log-opt keys to appropriate values in the daemon.json file, which is located in /etc/docker/ on Linux hosts or C:\ProgramData\docker\config\daemon.json on Windows Server. For more about configuring Docker using daemon.json, see daemon.json.

The following example sets the log driver to syslog and sets the syslog-address option. The syslog-address options supports both UDP and TCP; this example uses UDP.

{
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "udp://1.2.3.4:1111"
  }
}

Restart Docker for the changes to take effect.

Note

log-opts configuration options in the daemon.json configuration file must be provided as strings. Numeric and boolean values (such as the value for syslog-tls-skip-verify) must therefore be enclosed in quotes (").

You can set the logging driver for a specific container by using the --log-driver flag to docker container create or docker run:

docker run \
      --log-driver syslog --log-opt syslog-address=udp://1.2.3.4:1111 \
      alpine echo hello world

Options

The following logging options are supported as options for the syslog logging driver. They can be set as defaults in the daemon.json, by adding them as key-value pairs to the log-opts JSON array. They can also be set on a given container by adding a --log-opt <key>=<value> flag for each option when starting the container.