Skip to main content
Sumo Logic

Docker Collection Methods

Learn about methods for collecting logs and metrics from Docker.

This page describes and compares alternative methods for collecting Docker logs and metrics. You can employ these methods in self-managed Docker environments or with managed Docker services like ECS and Swarm.

If you use Kubernetes, see Kubernetes Collection Methods.

Support for logs and metrics

The following table summarizes what you can collect with each collection method. 

Collection Methods Logs Metrics
Docker Logging Driver X  
Installed Collector on Docker Host

(with Docker Log source and Docker Stats source)
X X
Collector as a Container

(with Docker Log source and Docker Stats source)
X X

Docker collection options

Sumo Logic Docker Logging Driver

The Sumo Logic Docker Logging Driver is a Docker plugin you can use to send Docker container logs to Sumo. Once your log data is in Sumo, you can use the Sumo web app to search and analyze it. This is a good option if you do not want to install collector on your Docker hosts. 

  • Pros
    • Agentless, uses an HTTP source.
    • Easier to set up.
    • You can configure all containers on a Docker host to use the driver, or start selected containers to do so by adding the logging options to the Docker command when you start the containers. 
  • Cons
    • HTTP sources do not have local caching, so data may be lost in the event of long periods of throttling. The Docker Logging Driver has basic retry functionality and limited caching, which might prevent or reduce data loss in the event of throttling.  
    • No metrics support.
    • May not work in all Docker environments.Versions of Docker prior to Docker Version 18.03.0-ce may not support the new plugin architecture.
    • Does not support the Sumo Docker app, which requires the use of Sumo’s Docker Stats source.

Installed Collector on Docker Host

In this method, you run an Installed collector on each Docker host machine, and use the Sumo sources for Docker, as described on Collect Logs and Stats from Docker. The Docker Log source collects logs from the containers running on the host and events from the Docker daemon. The Docker Stats source collects container metrics. You can install the collector manually, like Chef, Puppet or Ansible, or build it into an image. 

  • Pros
    • Full visibility.  Using this method you could collect anything on the Docker host, including: 
      • Container Logs
      • Container Metrics
      • Host Logs
      • Host Metrics (Sumo's Host Metrics source is required.)
    • Logs are cached locally, so if a source is throttled by Sumo, you won’t drop data.  
    • You can bake the installed collectors into an AMIs to allow for consistent deployments across all your hosts.
    • Configurable metadata. You can use variables available from Docker and the Docker host to configure the sourceCategory and sourceHost for a Docker log source or a Docker stats. For more information, see Configure sourceCategory and sourceHost using variables.
  • Cons
    • Maintaining AMIs can be tricky if the process is not automated, so this might be a disadvantage, depending on your situation and resources. 
    • It’s not as easy to set up this method to monitor selected containers on a host, as opposed to all containers. You might need to configure multiple sources to achieve this goal.

Collector as a Container

In this method, you run the collector as a container on the host machine and use a Docker Log and/or Docker Stats source to collect data. The Docker Log source will collect logs from the containers running on the host and events from the Docker daemon. The Docker Stats source will collect the container metrics. 

  • Pros
    • No need to bake into any AMIs. Can be fully automated depending on your automation tooling around Docker.
    • The collector will cache the files in the container, so if a source is throttled by Sumo, you won’t drop data.  Ensure that you have ample space, or use persistent storage.  
    • Easy to upgrade:  it’s a container, just deploy a new one!
    • Configurable metadata. You can use variables available from Docker and the Docker host to configure the sourceCategory and sourceHost for a Docker log source or a Docker stats. For more information, see Configure sourceCategory and sourceHost using variables.
  • Cons
    • With this method, you cannot collect host metrics from the Docker host. The collector must be installed on the Docker host to get the host metrics. You can still collect container logs, container metrics and host logs.
    • It’s not as easy to set up this method to monitor selected containers on a host, as opposed to all containers. You might need to configure multiple sources to achieve this goal.

Docker Platform Considerations

The following table describes the collection methods that are supported by different Docker platforms.

Platform Installed Collector On Docker Host Collector As Container Docker Logging Driver
Docker
(not managed service)
X X X*
ECS X X X*
Docker Swarm X X X*
Rancher (non-Kubernetes) X X X*

Sumo Apps for Docker

Sumo provides two apps for Docker: