Logs and Monitoring

Docker Logging

When running microservices, centralized logging is critical because checking individual containers is unscalable.

The Basics: A running application inside a container spits out logs to standard output (STDOUT) and standard error (STDERR). You view these via docker logs <container_name>.

docker logs --help
Usage:  docker logs [OPTIONS] CONTAINER
Options:
      --details        Show extra details provided to logs
  -f, --follow         Follow log output
      --since string   Show logs since timestamp (e.g. "2013-01-02T13:23:37Z") or relative (e.g. "42m" for 42 minutes)
  -n, --tail string    Number of lines to show from the end of the logs (default "all")
  -t, --timestamps     Show timestamps
      --until string   Show logs before a timestamp (e.g. "2013-01-02T13:23:37Z") or relative (e.g. "42m" for 42 minutes)

Logging Drivers: Docker captures these streams and routes them using “Logging Drivers.”
- json-file (Default): Docker writes the logs to a JSON file on the host machine.
- Alternative Drivers: syslog, journald, fluentd, awslogs (CloudWatch), splunk.
Global Configuration: You can change the default driver for all new containers by editing the /etc/docker/daemon.json file on the host server and restarting the Docker daemon.
Per-Container Configuration: You can override the global default on a single container at runtime using flags:
Terminal window
```
docker run -d --name my-app --log-driver fluentd --log-opt fluentd-address=localhost:24224 nginx
```

Monitoring & Inspecting Containers

To maintain cluster health, you must monitor image counts, container states, volumes, CPU/Memory usage, network bandwidth, and disk I/O.

Useful Monitoring CLI Commands

docker system info: High-level system statistics.
docker system df: Shows Docker disk usage (active vs reclaimable space).
docker system df -v: Verbose breakdown of exact sizes of images, containers, and volumes.
docker ps -s: Lists containers and includes their total file sizes on disk.
docker stats --no-stream: Live resource usage statistics (CPU, RAM, Net I/O). The -no-stream flag takes a single snapshot instead of a continuous feed.
docker ps -f status=exited: Filters and shows only stopped/dead containers.
docker images -f dangling=true: Shows untagged/unused images.
docker volume ls -f dangling=true: Shows orphaned volumes.

Advanced Monitoring Tools

1. cAdvisor (Container Advisor by Google): A tool that runs as a container and provides a web UI and metrics stream. It requires deep host-level volume mounts to analyze the system:

version: "3.6"
services:
  web:
    image: google/cadvisor:latest
    ports:
      - "0.0.0.0:9104:8080"
    volumes:
      - /:/rootfs:ro          # Read-only access to host root filesystem
      - /var/run:/var/run:rw  # Read-write to the Docker socket
      - /sys:/sys:ro          # Read-only to cgroups
      - /var/lib/docker/:/var/lib/docker:ro # Read-only to Docker data
      - /dev/disk/:/dev/disk:ro # Read-only to disk metrics

2. Prometheus: An industry-standard time-series database. It scrapes data from the Docker daemon (configured via /etc/docker/daemon.json with "metrics-addr": "0.0.0.0:9323", "experimental": true) or from cAdvisor. It integrates deeply with Alertmanager for notifications.