Need to have a separate log file for all docker events logs

[milindchawre]

Description

Docker provides a way to capture all the events logs using "docker events" command.
But docker currently, don't save these events logs in any file.
Docker should store all these events log in a separate file, so that as a user I can analyse all the events taking place in my containerized plaform.
Since docker don't provide this, I need to write a separate systemd service that depends on docker service and it redirects the "docker events" logs to a separate file.

Describe the results you received:
"docker events" don't logs in any file.

Describe the results you expected:
"docker events" should store all the events logs in a separate file.

Output of docker version:

Client:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:        
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:        
 OS/Arch:      linux/amd64

Output of docker info:

Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 97
Server Version: 1.12.1
Storage Driver: devicemapper
 Pool Name: docker-253:1-650320-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 10.74 GB
 Backing Filesystem: xfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 5.223 GB
 Data Space Total: 107.4 GB
 Data Space Available: 44.74 GB
 Metadata Space Used: 6.988 MB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.14 GB
 Thin Pool Minimum Free Space: 10.74 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--storage-opt dm.thinpooldev` to specify a custom block storage device.
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.107-RHEL7 (2016-06-09)
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: null overlay host bridge
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: seccomp
Kernel Version: 3.10.0-327.13.1.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 1.954 GiB
Name: dockerhost.cisco.com
ID: BLND:CG2Q:6TZJ:KBUU:LPON:F6CG:LZBO:OVKT:P67J:YHQO:XD7M:HE77
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Insecure Registries:
 127.0.0.0/8

[thaJeztah]

Can you describe the use case? Also, is there a reason to put these in a separate log file, instead of in the main logs for the daemon?

[milindchawre]

@thaJeztah
Usecase was to only separately visualize docker events like container start, stop, abort, etc.
These events logs are there somewhere in the main docker daemon log file but I don't find anyway to filter out only events logs out of it, the only option was "docker events" command.

[AkihiroSuda]

I think this can be done using docker events --format and redirection

[milindchawre]

@AkihiroSuda
I think you didn't get my question, I can use filters on "docker events" command, but here I want all the events separately in a file. "Docker events" just provide the runtime events logs, whereas I need all the older events logs too. I did the same redirection stuff, but I want a better way.
So there should either a separate file with all the events logs or should have a way to filter out events logs from main docker daemon logfile.

@thaJeztah
I do see that the main docker daemon logfile don't seems to have logs like network creation, container die, kill events and docker pull, push events, etc it only seems to have container start stop events.

[thaJeztah]

"Docker events" just provide the runtime events logs, whereas I need all the older events logs too

Can you explain what events are missing? For example, to get logs of the last 24 hours;

docker events --since 24h

I do see that the main docker daemon logfile don't seems to have logs like network creation, container die, kill events and docker pull, push events, etc it only seems to have container start stop events.

In debug mode, the daemon also logs every API call that is made, but it's not a strict / JSON format if that's what you're looking for.

Note that for other metrics, you may be interested in the new "Daemon metrics" experimental feature that's being added in docker 1.13; see https://github.com/docker/docker/blob/v1.13.0-rc4/docs/reference/commandline/dockerd.md#daemon-metrics

[milindchawre]

@thaJeztah
Was not aware about the since filter. But still I can't put this filter, because I need all the events log right from the beginning when the docker daemon was installed on the node. Can think of using a cron job that update last 24 hrs logs, but have observed that cron fails if docker daemon is in dead state, so it will miss few of the events logs and its little hacky.
Also can't afford running docker daemon in debug mode, it creates too many logs and consumes lots of space.
Anyways thanks for the info!

[cpuguy83]

@milindchawre I do not think events is the right thing here.
If you need events for everything, and for all time, you should consider using an authz plugin which can just log requests for you.

docker events is a rolling log, and has at most 1000 events at a time.

The prometheus integration in 1.13 may also be helpful for you.

[cpuguy83]

I think this should be closed, as I do not see the upside of having a continuously growing log file.

[thaJeztah]

I agree, I think adding this to the base functionality of the daemon is not needed; various solutions exist to allow this, and docker exposes an API exactly for this; to provide information to external consumers