将容器日志发送到 STDOUT 和 STDERR 是Docker 的默认日志行为。实际上，Docker提供了多种日志机制帮助用户从运行的容器中提取日志信息。这些机制被称作logging driver 。
Docker 的默认 logging driver 是 json-file
root@host1:~# docker info | grep 'Logging Driver'
Logging Driver: json-file
如果容器在启动时没有特别指明，就会使用这个默认的 logging driver。
json-file 会将容器的日志保存在json文件中，Docker 负责格式化其内容并输出到 STDOUT 和 STDERR
我们可以在 Host 的容器目录中找到这个文件，日志的位置在
[root@ubuntu ~]# docker inspect web03 | jq .[].HostConfig.LogConfig
{
"Type": "json-file",
"Config": {}
}
[root@ubuntu ~]# docker inspect web03 | jq .[].LogPath
"/var/lib/docker/containers/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30-json.log"
比如我们看之前httpd容器的json格式的日志文件。
[root@ubuntu ~]# docker logs web03
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.4. Set the 'ServerName' directive globally to suppress this message
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.4. Set the 'ServerName' directive globally to suppress this message
[Thu May 09 01:07:37.761772 2019] [mpm_event:notice] [pid 1:tid 140651667042368] AH00489: Apache/2.4.39 (Unix) configured -- resuming normal operations
[Thu May 09 01:07:37.761911 2019] [core:notice] [pid 1:tid 140651667042368] AH00094: Command line: 'httpd -D FOREGROUND'
10.12.28.253 - - [09/May/2019:01:07:44 +0000] "GET /httpd_access_testweb03 HTTP/1.1" 404 220
10.12.28.253 - - [09/May/2019:01:08:09 +0000] "GET /httpd_access_testweb03 HTTP/1.1" 404 220
10.12.28.253 - - [09/May/2019:01:08:09 +0000] "GET /httpd_access_testweb03 HTTP/1.1" 404 220
10.12.28.253 - - [09/May/2019:01:08:11 +0000] "GET /httpd_access_testweb03_01 HTTP/1.1" 404 223
10.12.28.253 - - [09/May/2019:01:08:12 +0000] "GET /httpd_access_testweb03_02 HTTP/1.1" 404 223
10.12.28.253 - - [09/May/2019:01:08:13 +0000] "GET /httpd_access_testweb03_03 HTTP/1.1" 404 223
[root@ubuntu ~]# docker inspect web03 | jq .[].LogPath
"/var/lib/docker/containers/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30-json.log"
[root@ubuntu ~]# cat /var/lib/docker/containers/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30/d777fe241f27b541a776e4e0eca4e86754e61d7fe324bb6720e46711707a5a30-json.log
{"log":"AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.4. Set the 'ServerName' directive globally to suppress this message\n","stream":"stderr","time":"2019-05-09T01:07:37.757312662Z"}
{"log":"AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using 172.17.0.4. Set the 'ServerName' directive globally to suppress this message\n","stream":"stderr","time":"2019-05-09T01:07:37.760288136Z"}
{"log":"[Thu May 09 01:07:37.761772 2019] [mpm_event:notice] [pid 1:tid 140651667042368] AH00489: Apache/2.4.39 (Unix) configured -- resuming normal operations\n","stream":"stderr","time":"2019-05-09T01:07:37.761957452Z"}
{"log":"[Thu May 09 01:07:37.761911 2019] [core:notice] [pid 1:tid 140651667042368] AH00094: Command line: 'httpd -D FOREGROUND'\n","stream":"stderr","time":"2019-05-09T01:07:37.76197126Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:07:44 +0000] \"GET /httpd_access_testweb03 HTTP/1.1\" 404 220\n","stream":"stdout","time":"2019-05-09T01:07:44.448412013Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:08:09 +0000] \"GET /httpd_access_testweb03 HTTP/1.1\" 404 220\n","stream":"stdout","time":"2019-05-09T01:08:09.313879068Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:08:09 +0000] \"GET /httpd_access_testweb03 HTTP/1.1\" 404 220\n","stream":"stdout","time":"2019-05-09T01:08:09.94122045Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:08:11 +0000] \"GET /httpd_access_testweb03_01 HTTP/1.1\" 404 223\n","stream":"stdout","time":"2019-05-09T01:08:11.813695979Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:08:12 +0000] \"GET /httpd_access_testweb03_02 HTTP/1.1\" 404 223\n","stream":"stdout","time":"2019-05-09T01:08:12.723122224Z"}
{"log":"10.12.28.253 - - [09/May/2019:01:08:13 +0000] \"GET /httpd_access_testweb03_03 HTTP/1.1\" 404 223\n","stream":"stdout","time":"2019-05-09T01:08:13.813166874Z"}
除了 json-file ，Docker 还支持多种 logging driver 。完成的列表可以访问docker官方网站查询 https://docs.docker.com/config/containers/logging/configure/#supported-logging-drivers
none 是disable 容器日志功能
syslogs 和 journald 是linux上两种日志管理服务
awslogs 、 splunk 和 gcplogs 是第三方日志托管服务
gelf 和 fluentd 是两种开源的日志管理方案
容器在启动时可以通过 --log-driver 指定使用的logging driver 。如果要设置Docker 默认的 logging driver ，需要修改 Docker daemon 的启动脚本，指定 --log-driver 参数，比如下面，每种 logging driver 都有自己的 --log-opt ，用的时候去官网查询即可
ExecStart=/usr/bin/dockerd -H fd:// --log-driver=syslog --log-opt ......
05-13 15:48