I’m using the syslog logging driver in Docker to forward container logs to a remote syslog server as shown below:
logging:
driver: syslog
options:
syslog-address: “tcp://SyslogServerIP:PortNo”
However, when the syslog server is down, I’m unable to view the logs locally using the docker logs command.
I expected that Docker would keep the logs locally on the host machine if the syslog server was unavailable, but this doesn’t seem to be the case.
My questions are:
Is this the expected behavior for the syslog logging driver in Docker?
How can I ensure that logs are stored locally in case the syslog server is unreachable?
Are there any Docker configuration options or alternative logging drivers that allow logs to be buffered locally when the syslog server is down?
I’m looking for a solution to retain logs locally while still forwarding them to a remote syslog server. Any guidance would be greatly appreciated!
It was, but there is “Dual logging” in the Docker Engine
That was introduced because originally only the “json-file” and “journald” drivers supported using the docker logs command, but I assume the main goal was not to use it when the remote server was unavialable, but only to support the docker logs command for recent log messages. If it is the case, I guess the driver cannot reach the server so it does not send logs or just keeps it in a buffer temporarily until the server is available again.
As I sometimes recommended it in other topics as well, I would probably just run promtail (or since it is deprecated, Grafana Alloy) and send logs to Loki for example, or use Fluent Bit (running in a container) and send logs to Syslog
I have not tried it in Docker Desktop yet, but it should be possible. Then your logs could be sent to the default json-file driver, and fluentbit could parse the logs and send to the remote server. When you know, the remote server is down, you can stop the fluentbit container too, but docker logs will work independently.