The syslog driver is sending the logs to syslog, not to the journal. To see the logs from inside the container, you can try running journalctl -b -u docker.service to see the logs from the docker service or you can add "journald" as the "log-driver" in the daemon.json file and then run journalctl -b to see the logs from the containers.
To make the change, you can edit the daemon.json file and update the "log-driver" field to "journald" like this:
If you use logger inside a container that will not go the the logging driver. That driver handles only the container’s standard output (stdout) and error stream (stderr). You can try the driver this way:
docker run --rm bash echo "stdoutDOCKER"
docker run --rm bash -c 'echo "stderrDOCKER" > /dev/stderr'
I didn’t know about this, but after trying the logging drivers again and searching for the relationship between journald and syslog I found a post that confirms that I suspected after playing with the drivers based on your message.
So it looks like it is not the logging driver that sends the logs to syslog and journald. Using the logger command had the same result. I haven’t tried other distributions but at least on Ubuntu, logs sent to syslog can appear in the journal and logs sent to journald can appear in sysllog as well.
Both are true. The logging driver handles only the container’s stdout and stderr. In my last message I was writing about logger on the host. So this is a host OS level setting. Logs will appear in the journal and also in syslog. Logger can’t send logs directly to the host from the container.
No. As I mentioned, this behavior has nothing to do with the log drivers. These are two different methods and how they send the logs to eachother depends on the operating system and the configurations.
We saw how it worked on Ubuntu by default and I also checked an old Centos server, where I tried the journald driver and I saw a strange entry like this: 6bcc8bc59370: [4B blob data].
Blob data instead of the text I have sent, but I found the text in the syslog. After that I tried the syslog driver and I saw the logs in both syslog and the journal as normal text.
So on Centos it looks like syslog (not the driver, but syslog itself) sends the logs to the journal as well or journld reads to logs from syslog, but when I use the journald driver, I can’t send logs directly to the journal from containers either because of a driver bug or the configuration of journald on CentOS.
Since it works for you, I suggest choose journald if you want to make sure the logs will be sent to the journal and syslog if you prefer syslog. Syslog would also support sending logs to a remote syslog server this is why it has different parameters than journald.
This is not a yes or know question… syslog and journald are logging servers, but Docker has logging drivers with the same name. The syslog logging driver sends the logs to Syslog and the journald logging driver sends the logs to journald.
As I already mentioned it is something that you have to configure on the host operating system. Docker can’t help you with that. I don’t know how you could configure it if it is possible at all.