Rationale

I am in the process of using Ansible playbooks to automate the provisioning of CentOS 7 servers I tend to create from time to time for hacking on some personal projects. One of my oldest dreams was to use systemd’s journald for all of my logging work, since it has a nice query language and I can on a future step send its logs (directly or indirectly) to elasticsearch for viewing them. I also tend to user docker to run my apps, but although the docker daemon by default logs to systemd, the containers themselves normally don’t. A nice bonus to set your containers to log on journald is that the docker logs command keeps working as its previous way. To check if this is the case, with the docker daemon online do: $ docker info | grep journal Logging Driver: journald In this case (CentOS 7), the containers are already prepared to log to journald. If your Logging Driver is different from that output, you can go on. Also notice is that you can change this driver on a container per container basis also. :)

How to make a single container replicate its logs to journald

$ docker run -it –log-driver=journald your-container-name-here

How to make all containers by default replicate their logs to journald

$ vim /etc/docker/daemon.json

{
"log-driver": "journald"
}

Then, restart the docker daemon and it should be working.

How to query journald:

• All logs: $ journalctl -o short-iso -f –all
• Docker logs: $ journalctl -o short-iso -f –all -u docker IMPORTANT: the -all parameter “decodes” the blob you otherwise would see from the containers if you omit that.