Shulou(Shulou.com)06/01 Report--

This article mainly introduces the docker log can not be retrieved how to do, the article is very detailed, has a certain reference value, interested friends must read it!

When checking the service daily, when you check the container log from portainer, you will find a red exclamation point in the upper right corner: Unable to retrieve container logs.

Because there was no such problem before, I first went to the server to look at the log with the command docker logs-f containerID, and found that the log could not move, or stayed on the log record at a certain time.

After thinking for a moment that the log of the service should not print out the problem, I searched it according to Google and found that it did not match my problem. Because logs can sometimes be collected and displayed, some logs are not allowed, so there should be a problem with the logging engine set by docker.

Originally, I wanted to have a whole set of EFK, but I felt that the log volume was not large enough now, so I didn't modify the log engine of docker, which is still the default journald.

[root@ad-official xiaoxiao] # docker info | grep Logging WARNING: You're not using the default seccomp profileLogging Driver: journald

There is a note on the official documentation of journald:

Man journald.conf... RateLimitInterval=, RateLimitBurst= Configures the rate limiting that is applied to all messages generated on the system. If, in the time interval defined by RateLimitInterval=, more messages than specified in RateLimitBurst= are logged by a service, all further messages within the interval are dropped until the interval is over. A message about the number of dropped messages is generated. This rate limiting is applied per-service, so that two services which log do not interfere with each other's limits. Defaults to 1000 messages in 30s. The time specification for RateLimitInterval= may be specified in the following units: "s", "min", "h", "ms", "us". To turn off any kind of rate limiting, set either value to 0. ...

It is written here that you can only receive 1000 logs in 30 seconds by default, as you can see here. Because a service with a daily log file size of almost 3G was released in docker not long ago, the logs of other services are also affected, and a large number of logs are discarded by journald, so we will have no problem modifying the configuration.

Open the / etc/systemd/journald.conf file, change the RateLimitBurst from the default 1000 to 5000, and adjust it according to your current log output:

[root@ad-official log] # cat / etc/systemd/journald.conf# This file is part of systemd.## systemd is free software; you can redistribute it and/or modify it# under the terms of the GNU Lesser General Public License as published by# the Free Software Foundation Either version 2.1of the License, or# (at your option) any later version.## Entries in this file show the compile time defaults.# You can change settings by editing this file.# Defaults can be restored by simply deleting this file.## See journald.conf (5) for details. [Journal] # Storage=auto#Compress=yes#Seal=yes#SplitMode=uid#SyncIntervalSec=5m#RateLimitInterval=30sRateLimitBurst=5000#SystemMaxUse=#SystemKeepFree=#SystemMaxFileSize=#RuntimeMaxUse=#RuntimeKeepFree=#RuntimeMaxFileSize=#MaxRetentionSec=#MaxFileSec=1monthForwardToSyslog=no#ForwardToKMsg=no#ForwardToConsole=noForwardToWall=no#TTYPath=/dev/console#MaxLevelStore=debug#MaxLevelSyslog=debug#MaxLevelKMsg=notice#MaxLevelConsole=info#MaxLevelWall=emerg#LineMax=48K

By the way, set ForwardToSyslog and ForwardToWall to no, because the default is yes, which will cause us to clean up the log files of journal, while those in Syslog will slowly fill up the disk.

Then restart journald to return to normal use: systemctl restart systemd-journald.service

The above is all the contents of the article "what to do if the docker log cannot be retrieved". Thank you for reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.