Change docker log messages location

Question

I met a problem with docker logging and after reading a lot of sources didn't find solution: is there a way to discard messages of docker daemon in /var/log/messages and select another location?

Answer 1

Ok, I know that this question is quite old but I don't think it has been answered well and no correct answer has been stated.

First of all the reason why it saves messages to that particular place starts in rsyslog configuration (/etc/rsyslog.conf) with the line:

$ModLoad imjournal # provides access to the systemd journal

So, because docker saves information to systemd journal it ends at /var/log/messages.

To be able to save it to other places, you have to create a rule like the following at /etc/rsyslog.d/docker.conf.

$FileCreateMode 0644
template(name="DockerLogFileName" type="list") {
   constant(value="/var/log/docker/")
   property(name="syslogtag" securepath="replace" \
            regex.expression="docker/\\(.*\\)\\[" regex.submatch="1")
   constant(value="/docker.log")
}
if $programname == 'dockerd' then \
  /var/log/docker/combined.log
if $programname == 'dockerd' then \
  if $syslogtag contains 'docker/' then \
    ?DockerLogFileName
  else
    /var/log/docker/no_tag/docker.log
$FileCreateMode 0600

I found the information for this configuration here: https://www.simulmedia.com/blog/2016/02/19/centralized-docker-logging-with-rsyslog/