---
title: Best Practices for Docker Logging Configuration
description: Learn best practices for configuring Docker logging to enhance performance, security, and management while preventing issues like disk saturation.
image: https://assets.seobotai.com/cdn-cgi/image/quality=75,w=1536,h=1024/dreamfactory.com/68bb7a4168bb5e38323cd66a-1757119451410.jpg
---

[![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/)

 Products & Services

[AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview)

[Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures)

AI Data Models

[AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere)

Services and support

[Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages)

API Management

[Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY)

 Use Cases

AI Use Cases

[AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance)

[Customer Case Studies](https://www.dreamfactory.com/case-studies)

[Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing)

 Industries

Industries

#### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare)

#### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services)

#### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government)

#### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing)

#### [Spotlight How enterprises run on DreamFactory From healthcare to energy to finance — governance baked into every endpoint. Browse case studies →](https://www.dreamfactory.com/case-studies)

 Connectors

SQL Database

[SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql)

NoSQL & Docs

[Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db)

Cloud Warehouses

[S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage)

C & SaaS

[Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest)

[See all 30+ connectors](https://www.dreamfactory.com/connectors)

[Blog](https://blog.dreamfactory.com/)

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

[![DreamFactory logo](https://cdn.prod.website-files.com/64ed8da8a866be7a702fbae0/68d51994d3678214b54acb60_dreamfactory-navbar-logo.svg)](https://www.dreamfactory.com/)

![hamburger](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/menu-hamburger.svg) ![close](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/close-menu.svg)

 Back to main menu

 Products & Services

 Use Cases

 Industries

 Connectors

[Blog](https://blog.dreamfactory.com/)

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

[AI Data Gateway](https://www.dreamfactory.com/ai-data-gateway/overview)

[Overview Why DreamFactory exists](https://www.dreamfactory.com/ai-data-gateway/overview) [Data Gov, Comp, Security Policy enforcement at the API layer](https://www.dreamfactory.com/ai-data-gateway/ai-data-governance) [Standard API Layer One contract for every backend](https://www.dreamfactory.com/ai-data-gateway/standard-api-layer) [API Gateway Functionality Routing, auth, rate limits, observability](https://www.dreamfactory.com/ai-data-gateway/api-gateway-functionality) [Deployment & Integration Self-hosted, cloud, hybrid](https://www.dreamfactory.com/ai-data-gateway/on-premise-deployment-and-integration) [Developer Productivity Auto-generated, never hand-coded](https://www.dreamfactory.com/ai-data-gateway/ai-development-accelerated) [AI App Architectures Patterns for RAG, agents, MCP](https://www.dreamfactory.com/ai-data-gateway/enterprise-ai-architectures)

AI Data Models

[AIOpenAI](https://www.dreamfactory.com/use-cases/openai) [GGoogle Gemini](https://www.dreamfactory.com/use-cases/google-gemini) [CAnthropic Claude](https://www.dreamfactory.com/use-cases/anthropic-claude-landing) [LMeta Llama](https://www.dreamfactory.com/use-cases/meta-llama) [MMistral AI](https://www.dreamfactory.com/use-cases/mistral) [CoCohere](https://www.dreamfactory.com/use-cases/cohere)

Services and support

[Quickstart Service Packages Expert-led Quickstarts to production](https://www.dreamfactory.com/services-and-support/quickstart-services-packages)

AI Data Models

[Generate & Manage REST APIs From any database, in seconds](https://www.dreamfactory.com/api-management/generate-rest-apis) [Features Security, scripting, self-hosted & more](https://www.dreamfactory.com/api-management/features) [API Generation The complete guide to auto-generated APIs](https://blog.dreamfactory.com/a-complete-guide-to-api-generation) [API Management Concepts, tools, and best practises](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools?_gl=1*jl0njh*_gcl_au*MjQzMjgwMTc3LjE3ODIzMjI3MzY)

AI Use Cases

[AI Data Access Secure, governed reads for your LLMs](https://www.dreamfactory.com/use-cases/ai-data-access) [MCP Server Drop-in Model Context Protocol](https://www.dreamfactory.com/use-cases/mcp-server) [Legacy Modernization Wrap mainframes with REST](https://www.dreamfactory.com/use-cases/legacy-modernization) [Data Governance Audit every call, enforce every policy](https://www.dreamfactory.com/use-cases/data-governance)

[Customer Case Studies](https://www.dreamfactory.com/case-studies)

[Energy Modernization](https://www.dreamfactory.com/case-studies/energy-snowflake-modernization) [Government Modernization](https://www.dreamfactory.com/case-studies/government-mainframe-oracle-modernization) [Government Business Intelligence](https://www.dreamfactory.com/case-studies/government-sql-server-bi-analyst-queries) [Manufacturing Modernization](https://www.dreamfactory.com/case-studies/steel-manufacturing-sap-erp-modernization) [Financial Services Investor Portal](https://www.dreamfactory.com/case-studies/financial-services-sql-server-investor-portal) [Non-Profit Partner Data Sharing](https://www.dreamfactory.com/case-studies/non-profit-sql-server-partner-data-sharing) [Professional Services Exec Dashboards](https://www.dreamfactory.com/case-studies/professional-services-erp-dashboards) [Education HR and External Data Sharing](https://www.dreamfactory.com/case-studies/education-student-hr-sql-server-mysql-external-data-sharing)

Industries

#### [Healthcare HIPAA-grade APIs across EHR, claims, and labs.](https://www.dreamfactory.com/use-cases/healthcare)

#### [Financial Services Portfolios, partners, and portals on one layer.](https://www.dreamfactory.com/use-cases/financial-services)

#### [Government Modernize mainframes without re-platforming.](https://www.dreamfactory.com/use-cases/government)

#### [Manufacturing SAP, MES, and shop-floor data, governed.](https://www.dreamfactory.com/use-cases/manufacturing)

SQL Database

[SQL SQL Server](https://www.dreamfactory.com/connectors/sql-server) [OR Oracle](https://www.dreamfactory.com/connectors/oracle) [PG PostgreSQL](https://www.dreamfactory.com/connectors/postgresql) [My MySQL](https://www.dreamfactory.com/connectors/mysql)

NoSQL & Docs

[Dy DynamoDB](https://www.dreamfactory.com/connectors/dynamodb) [Do DocumentDB](https://www.dreamfactory.com/connectors/azure-documentdb) [Mo MongoDB](https://www.dreamfactory.com/connectors/mongodb) [Cb CouchDB](https://www.dreamfactory.com/connectors/couch-db)

Cloud Warehouses

[S3 S3](https://www.dreamfactory.com/connectors/amazon-s3) [Ab Azureblob](https://www.dreamfactory.com/connectors/azure-blob) [FS FTP/SFTP](https://www.dreamfactory.com/connectors/ftp-sftp) [LS Local Storage](https://www.dreamfactory.com/connectors/local-storage)

C & SaaS

[Sf Salesforce](https://www.dreamfactory.com/connectors/salesforce) [API REST / SOAP](https://www.dreamfactory.com/connectors/soap-to-rest)

[See all 30+ connectors](https://www.dreamfactory.com/connectors)

[![back arrow](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/orange-arrow.svg) Blog](https://blog.dreamfactory.com/)

# Best Practices for Docker Logging Configuration

 by Kevin Hood

![calendar icon](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/calendar-icon.svg) September 5, 2025

Table of contents

RECOMMENDED ARTICLES

- [A Complete Guide to API Generation](https://blog.dreamfactory.com/a-complete-guide-to-api-generation)
- [10 Best API Management Tools](https://blog.dreamfactory.com/what-is-api-management-a-brief-overview-of-api-management-concepts-and-tools)
- [Creating a Microsoft SQL Server API in Less Than 5 minutes with DreamFactory](https://blog.dreamfactory.com/creating-a-microsoft-sql-server-api-in-less-than-5-minutes-with-dreamfactory)
- [Hasura vs. DreamFactory: A Comprehensive Comparison](https://blog.dreamfactory.com/hasura-vs-dreamfactory)
- [Build A Snowflake REST API in Less Than 5 Minutes](https://blog.dreamfactory.com/generate-a-snowflake-rest-api-in-less-than-5-minutes)

When managing [Docker](https://www.docker.com/) containers, effective logging is essential for troubleshooting, monitoring, and ensuring compliance. Mismanaged logs can lead to disk space issues, performance bottlenecks, and lost diagnostic data. Here's a quick breakdown of what you need to know:

- **Choose the right logging driver**: Options include `json-file` (default), `syslog`, `journald`, `fluentd`, and `none`. Each has unique benefits depending on storage, performance, and integration needs.
- **Set up log rotation**: Prevent logs from consuming disk space by configuring `max-size` and `max-file` parameters.
- **Enable centralized logging**: Use drivers like `syslog` or `fluentd` to forward logs to remote servers for better retention and analysis.
- **Optimize** [**log delivery**](https://wiki.dreamfactory.com/DreamFactory/Features/Log_Services): Use non-blocking mode for high-performance applications to avoid delays, but be mindful of potential log loss.
- **Secure logs**: Encrypt log transmissions (e.g., with TLS) and enforce access controls to protect sensitive data.
- **Monitor and audit configurations**: Regularly check logging settings and resource usage to ensure stability and compliance.

**Quick Tip**: For production environments, consider centralized logging systems like [Fluentd](https://www.fluentd.org/) or Syslog for better scalability and integration with monitoring tools. Use log rotation to avoid disk saturation and configure non-blocking delivery for performance-critical applications.

This guide provides actionable steps to configure Docker logging effectively, ensuring your containers run smoothly while keeping logs manageable and secure.

## Docker Logging - "docker logs" Command | Log Drivers | Logging Strategies

## Choosing the Right Docker Logging Driver

Docker provides a variety of logging drivers tailored to different needs. The choice you make impacts how logs are stored, accessed, and integrated. Picking the wrong one can lead to issues like performance bottlenecks, excessive storage use, or even losing critical diagnostic data.

### Common Docker Logging Drivers Overview

The **json-file driver** is Docker's default option. It stores logs in JSON format, making them easy to access with the `docker logs` command. This setup works well for straightforward use cases.

**Syslog** sends Docker logs to the system's logging service, allowing messages to be routed to local syslog daemons or remote syslog servers. It's a great fit for organizations already using centralized syslog systems. Syslog supports both UDP and TCP, with TCP providing more reliable delivery for critical data.

**Journald** is exclusive to systemd-based Linux distributions like [Ubuntu](https://ubuntu.com/) 16.04+ and [CentOS](https://www.centos.org/) 7+. It integrates with the system's journal, offering structured logs with metadata and automatic rotation. This driver is ideal for environments where admins prefer managing logs with systemctl and journalctl.

**Fluentd** connects Docker directly to the Fluentd log collector, enabling advanced [log processing](https://wiki.dreamfactory.com/DreamFactory/Tutorials/V8_log_login_events_to_logstash). It supports features like buffering, filtering, and forwarding logs to multiple destinations in real time. This makes it a strong choice for complex setups that require detailed log analysis and multi-destination routing.

The **none driver** disables logging entirely. It’s useful for high-performance scenarios where logging overhead needs to be avoided or where logging is handled internally by the application.

### Logging Driver Comparison

| Driver | Disk Usage | Performance Impact | Remote Logging | Log Rotation | Best For |
| --- | --- | --- | --- | --- | --- |
| json-file | High (no automatic cleanup) | Low | No | Manual/external tools | Development, simple setups |
| syslog | Low (managed by syslog) | Medium | Yes | Built-in | Traditional infrastructure |
| journald | Medium (automatic rotation) | Low | Limited | Automatic | systemd environments |
| fluentd | Low (forwarded immediately) | Medium-High | Yes | Not applicable | Complex log processing |
| none | None | Minimal | No | Not applicable | High-performance scenarios |

### Driver Selection Criteria

When choosing a logging driver, think about the specific needs of your setup. Here are some key factors to consider:

- **Scalability**: For high-traffic applications, local storage might not be enough. Drivers like syslog and fluentd forward logs to remote destinations, preventing disk space from filling up. For example, platforms like [DreamFactory](https://dreamfactory.com/), which handle thousands of requests, would benefit from such drivers to avoid overwhelming local storage.
- **Integration with existing tools**: If your organization relies on centralized monitoring or auditing tools, drivers like syslog or fluentd are better options. Local-only drivers, such as json-file, risk losing logs when containers are removed.
- **Performance requirements**: In high-throughput scenarios, logging overhead can affect application performance. The none driver eliminates logging overhead entirely but sacrifices visibility. Json-file balances performance and local storage, while syslog and fluentd may introduce network latency.
- **Regulatory needs**: In industries with strict compliance requirements, syslog or fluentd ensures logs are retained for audits, even if containers are deleted.
- **Team expertise**: Choose a driver your team is comfortable managing. For example, if your team is familiar with systemd, journald might be a natural fit. On the other hand, syslog appeals to those with experience in traditional Unix logging. Advanced options like fluentd may require additional training and time to implement effectively.

## Setting Up Logging Drivers for Containers and Daemon

Once you've chosen a logging driver, you can configure it at the daemon level or for individual containers. Docker allows you to set global defaults or customize settings for specific containers. Below, we'll walk through both approaches.

### Configuring Default Logging Driver in `daemon.json`

Setting a default logging driver simplifies the process by automatically applying the configuration to all new containers. You can define this in Docker's `daemon.json` file, which manages daemon-wide settings.

The `daemon.json` file is located at `/etc/docker/daemon.json` on Linux or `C:\ProgramData\docker\config\daemon.json` on Windows Server. If the file doesn’t exist, you’ll need to create it with proper JSON formatting.

For example, to set the **local** driver as the default (a common choice for many scenarios), add the following:

```
{
  "log-driver": "local"
}
```

If you prefer the **json-file** driver with log rotation, use the following configuration:

```
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "labels": "production_status",
    "env": "os,customer"
  }
}
```

Remember, Docker requires all `log-opts` values to be written as strings, even if they represent numbers or booleans.

For centralized logging with [**Grafana Loki**](https://grafana.com/oss/loki/), you can configure it like this:

```
{
  "debug": true,
  "log-driver": "loki",
  "log-opts": {
    "loki-url": "https://<user_id>:<password>@logs-us-west1.grafana.net/loki/api/v1/push",
    "loki-batch-size": "400"
  }
}
```

After updating the `daemon.json` file, restart the Docker daemon to apply changes. On Linux, use:

```
sudo systemctl restart docker
```

> "Changing the default logging driver or logging driver options in the daemon configuration only affects containers that are created after the configuration is changed. Existing containers retain their original logging driver configuration. To update the logging driver for a container, the container has to be re-created with the desired options." - Docker Documentation

This means that any containers running before the daemon restart will continue using their existing logging configuration. To apply the new defaults, you'll need to stop, remove, and recreate those containers.

### Container-Specific Logging Driver Setup

In some cases, you might need custom logging configurations for individual containers. Docker lets you override the default logging driver at runtime using the `--log-driver` flag.

For example, to disable logging entirely for a performance-critical container, use the **none** driver:

```
docker run -it --log-driver none alpine ash
```

If you want to use the **local** driver with specific log rotation settings:

```
docker run -it --log-driver local --log-opt max-size=10m --log-opt max-file=3 alpine ash
```

For containers that need to send logs to a remote system, such as with the **syslog** driver, specify the destination address:

```
docker run --log-driver syslog --log-opt syslog-address=tcp://192.168.1.10:514 -d nginx
```

When dealing with applications that generate a high volume of logs, you can enable non-blocking mode to reduce performance overhead:

```
docker run -it --log-opt mode=non-blocking --log-opt max-buffer-size=4m alpine ping 127.0.0.1
```

You can combine multiple `--log-opt` flags to fine-tune your container's logging behavior.

### Checking Current Logging Driver Settings

It's important to verify your logging configurations to ensure they're set up correctly. Docker provides commands to check both daemon-wide and container-specific logging settings.

To see the current default logging driver for the daemon, run:

```
docker info --format ''
```

This will display the active default driver, such as `json-file` for a fresh installation or the one you've configured.

To inspect a specific container's logging configuration, use:

```
docker inspect -f '' container_name_or_id
```

Replace `container_name_or_id` with the actual name or ID of the container. If you're working in a [Kubernetes](https://kubernetes.io/) environment, you can first retrieve the container ID with:

```
kubectl get pod <pod-name> -n <namespace> -o jsonpath='{.status.containerStatuses[*].containerID}'
```

Then, use the `docker inspect` command with the extracted container ID.

Regularly checking these settings can help you catch misconfigurations early, avoiding issues like missing logs or excessive storage usage. This is especially critical in production environments, where reliable logging is essential for troubleshooting and monitoring.

## Improving Log Delivery and Performance

The way Docker handles logging can significantly influence how responsive and reliable your application is. Ensuring logs are delivered efficiently is crucial for maintaining performance in containerized environments.

### Blocking vs Non-Blocking Log Delivery Modes

Choosing the right log delivery mode is key to optimizing performance. Blocking mode prioritizes reliability but can slow things down, while non-blocking mode focuses on keeping your application running smoothly, even if it risks losing some logs during heavy activity.

In **blocking mode**, the application halts until each log message is successfully delivered. This ensures no logs are lost, but it can cause delays, especially when using remote logging drivers. For instance, if the network is slow or a remote logging service like gcplogs or awslogs lags, your application might experience pauses.

On the other hand, **non-blocking mode** uses a ring buffer to queue log messages. This allows the application to continue running without waiting for logs to be delivered. While this improves performance, there’s a chance of losing logs if the buffer fills up before the logging driver processes them.

The impact of these modes becomes more noticeable with remote logging drivers - like syslog, fluentd, or awslogs - where network delays can slow down blocking mode. Local drivers, such as json-file or local, tend to perform better in blocking mode since they write directly to disk, avoiding network-related delays.

| Feature | Blocking Mode (Default) | Non-Blocking Mode |
| --- | --- | --- |
| **Log Reliability** | Ensures all logs are delivered | Risk of log loss if the buffer overflows |
| **Application Performance** | Can slow down, especially with remote drivers | Maintains smooth performance |
| **Memory Usage** | Minimal extra memory usage | Uses a configurable ring buffer (default 1MB) |
| **Best Use Cases** | Local logging or when all logs must be retained | High-volume logging and performance-critical applications |
| **Network Dependency** | Affected by network delays | Shields app performance from network issues |

Once you determine the best mode for your needs, you can fine-tune it with buffer size adjustments to handle your application's logging demands.

### Setting Up Delivery Modes and Buffer Sizes

After deciding on a delivery mode, configure it to align with your application's logging volume and performance requirements.

For local logging drivers like json-file, blocking mode usually works well because disk writes are fast. However, if your application generates a high volume of logs or performs heavy disk operations, switching to non-blocking mode can prevent logging from slowing things down.

```
docker run -d --log-driver local --log-opt mode=non-blocking --log-opt max-buffer-size=4m nginx
```

For remote logging drivers, non-blocking mode is generally a better choice. Here’s an example configuration for syslog:

```
docker run -d --log-driver syslog \
--log-opt syslog-address=tcp://logs.example.com:514 \
--log-opt mode=non-blocking \
--log-opt max-buffer-size=8m \
my-application
```

The default buffer size is 1MB, but you can adjust it based on your application's needs. For moderate log volumes, a 2–4MB buffer is often sufficient. For high-volume scenarios, consider increasing it to 8–16MB. For example, if your application generates about 100KB of logs per second, a 1MB buffer would fill up in 10 seconds, which might not be enough. Larger buffers can handle spikes in log activity but require more memory.

If your application is mission-critical and must retain every log, stick with blocking mode, even if it affects performance.

Keep an eye on memory usage to avoid buffer overflows. While larger buffers offer more flexibility during brief slowdowns, they also increase the risk of losing logs if the container crashes before the buffer is processed. Striking the right balance between buffer size, memory limits, and performance is key.

## Setting Up Log Rotation and Retention Policies

Without proper log rotation and retention policies, Docker containers can quickly eat up all available disk space, which could lead to serious issues like disk saturation. By setting up these policies, you can manage logs effectively, keep your system running smoothly, and ensure logs are stored only for as long as needed. Here's how you can configure these settings to maintain a healthy balance between log retention and disk usage.

### Configuring Log Rotation Parameters

Docker prevents logs from growing out of control by rotating them - essentially creating a new log file once the current one reaches a specific size. It also limits how many old log files are kept, deleting the oldest ones when the limit is reached. This behavior is controlled by two parameters:

- **max-size**: Defines the maximum size of a single log file before it’s rotated.
- **max-file**: Sets the maximum number of log files to retain.

For most scenarios, setting a **max-size** of 10MB works well. It avoids creating too many small files while keeping individual files manageable:

```
docker run -d --log-driver json-file \
--log-opt max-size=10m \
--log-opt max-file=3 \
nginx
```

This example keeps up to three log files per container, each up to 10MB, for a total of 30MB of logs. When a fourth file is created, the oldest log file is automatically deleted.

If your application generates a higher volume of logs or has specific needs, you can adjust these settings. For instance:

```
# High-volume apps (up to 250MB total)
docker run -d --log-driver json-file \
--log-opt max-size=50m \
--log-opt max-file=5 \
my-high-volume-app

# Development environments (up to 10MB total)
docker run -d --log-driver json-file \
--log-opt max-size=5m \
--log-opt max-file=2 \
my-dev-app
```

To fine-tune these settings, monitor your container logs for a few days to understand how much data they generate. This will help you match rotation parameters to your app’s needs and available disk space.

### Enforcing Retention Policies

After setting rotation parameters, applying retention policies ensures consistent [log management](https://wiki.dreamfactory.com/DreamFactory/Tutorials/Node_log_login_events_to_logstash) across your containers. You can configure these policies globally at the Docker daemon level or customize them for individual containers.

To apply default settings for all containers, edit the Docker daemon configuration file located at `/etc/docker/daemon.json`:

```
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
```

Once you’ve updated the file, restart the Docker service to apply the changes:

```
sudo systemctl restart docker
```

These default settings will apply to all new containers unless overridden. This approach simplifies log management by ensuring consistent rules without needing to manually configure every container.

For applications requiring different retention settings, you can override the defaults. For example:

```
# Database containers with longer retention
docker run -d --log-driver json-file \
--log-opt max-size=25m \
--log-opt max-file=10 \
postgres:13

# Web servers with faster rotation
docker run -d --log-driver json-file \
--log-opt max-size=5m \
--log-opt max-file=2 \
nginx
```

When defining retention policies, consider factors like compliance requirements, debugging needs, and available storage. For example, financial systems may need logs stored for months, while development environments might only need a few days of history.

To further optimize, combine local log rotation with external log shipping. This way, you can keep a small amount of logs locally for quick access while sending everything to a centralized system for long-term storage:

```
docker run -d --log-driver json-file \
--log-opt max-size=10m \
--log-opt max-file=2 \
--log-opt labels=environment=production \
my-production-app
```

Keep in mind that log rotation applies only to certain drivers like **json-file** and **local**. If you’re using remote logging drivers like **syslog** or **fluentd**, retention must be configured on the external logging system, not within Docker itself.

## Securing Log Management

Once you've set up proper log rotation and retention policies, the next step is to ensure your logs are secure. This is crucial for protecting sensitive data across your containerized infrastructure, especially before integrating logs with centralized monitoring systems.

### Securing Log Access and Transmission

To safeguard your log data, focus on controlling both access and transmission. Docker logs can often include sensitive details like user information, API keys, and credentials. To protect this data, encrypt it during transmission and enforce strict access controls on stored logs.

For log transmission, encryption is key. Use **TLS (Transport Layer Security)** to secure data in transit. When configuring the Syslog driver, include options like `syslog-tls-cert`, `syslog-tls-key`, and `syslog-tls-ca-cert`. Here's an example of how to configure encrypted Syslog transmission with TLS:

```
docker run -d --log-driver syslog \
  --log-opt syslog-address=tcp://log-server.company.com:6514 \
  --log-opt syslog-tls-cert=/path/to/client.crt \
  --log-opt syslog-tls-key=/path/to/client.key \
  --log-opt syslog-tls-ca-cert=/path/to/ca.crt \
  --log-opt tag="/" \
  nginx
```

This configuration ensures that data is securely transmitted between your Docker containers and the logging server. By using mutual certificate authentication, you can also minimize the risk of man-in-the-middle attacks.

On the centralized logging server, enforce strict access controls. Many logging platforms offer **role-based access control (RBAC)**, allowing you to define who has permissions to view, search, or export log streams. This helps limit access to sensitive information.

Keeping your Docker environment and logging tools up to date is another critical step. Regular updates ensure that vulnerabilities are patched, reducing the risk of breaches.

Lastly, categorizing your logs can add another layer of security. Use Docker labels and custom log tags to separate sensitive logs from general application logs. This way, you can apply additional protections to the most critical data while managing less sensitive logs more efficiently.

## Monitoring and Auditing Logging Configuration

After setting up your logging configuration, the next step is to ensure it stays effective and secure over time. This requires ongoing monitoring and regular audits to catch potential issues early and maintain compliance.

### Auditing Logging Settings

To keep your Docker logging configuration in check, make regular audits a priority. Start by documenting all container setups to establish a clear baseline. This makes it easier to spot any unexpected changes or problems.

Take a close look at your **daemon.json** file to confirm that the default logging driver settings haven’t been altered. If you’re unsure how to do this, refer back to the 'Checking Current Logging Driver Settings' section, where commands like `docker info` and `docker inspect` are explained.

It’s also a good idea to create a monthly audit checklist. This should include tasks like verifying that log rotation policies are functioning properly. Double-check that your maximum file sizes and retention periods are aligned with both your storage capacity and compliance needs. For those using the **json-file** driver, ensure the `max-size` and `max-file` parameters are configured to prevent excessive disk usage.

Another critical step is reviewing access controls for your log files and directories. Make sure only authorized users and processes can access sensitive log data. On Linux systems, you can use `ls -la` to check permissions on log directories, which are typically located in `/var/lib/docker/containers/`.

If you discover any configuration drift - where settings have deviated from their intended standards - document these changes. Drift can occur due to manual adjustments or misaligned deployments. Tracking these incidents will help you identify patterns and improve your overall deployment process.

Once you’ve confirmed that your configuration is intact through auditing, shift your focus to real-time monitoring to ensure smooth log delivery and performance.

### Tracking Log Delivery and Buffer Usage

Auditing is just one piece of the puzzle. Actively monitoring log delivery and buffer usage is key to catching performance issues before they escalate. Docker offers several tools to help you keep tabs on your logging pipeline.

Start with **Docker stats** to monitor resource usage in your containers. For instance, high memory usage in containers using non-blocking log delivery modes could indicate buffer overflow problems. Run `docker stats --no-stream` to get a quick snapshot of current resource consumption across your containers.

If you’re using blocking log delivery modes, watch for slowdowns that might signal delays in the logging driver. Keep an eye on centralized logging ingestion rates as well - sudden drops could point to delivery failures, while spikes might indicate excessive log generation.

Set up alerts in your monitoring system for key logging metrics. Some important ones to track include disk space usage in log directories, network connectivity to remote logging endpoints, and buffer utilization rates. Many organizations configure alerts when log directories reach 80% capacity, giving them enough time to address storage concerns before they lead to failures.

Don’t forget to check the Docker daemon logs for any error messages related to logging. On systems using systemd, you can use `journalctl -u docker.service` to review these logs. They often provide early warnings about issues like failed log deliveries or problems with driver initialization.

Finally, monitor your application’s response times and throughput across different logging configurations. This will help you strike the right balance between log accuracy and overall performance.

## Conclusion: Docker Logging Best Practices Summary

Managing Docker logs effectively is all about finding the right balance between performance, security, and operational efficiency. The choice of a logging driver is central to this balance. For example, the **json-file** driver works well in development, offering simplicity and ease of use. On the other hand, production environments often benefit from more advanced options like **fluentd**, which can handle complex logging needs.

It's also vital to configure log drivers and set up log rotation properly. Doing so prevents storage issues and supports a stronger security posture. Beyond configuration, protecting log transmission and access is critical, especially when sensitive data is involved. This is particularly true for organizations using platforms like DreamFactory's Data AI Gateway, where secure management of logs is essential due to the sensitive nature of [database connections](https://wiki.dreamfactory.com/DreamFactory/Tutorials/Connecting_to_Data_Sources) and [API transactions](https://wiki.dreamfactory.com/DreamFactory/Features/API_Limits). Steps like encrypting transmission channels, implementing strict access controls, and using centralized monitoring tools can go a long way in safeguarding both logs and the data they contain.

Proactive measures like regular audits and real-time monitoring help detect and resolve issues before they cause disruptions. This approach is especially important in environments where APIs handle high-volume database operations across multiple connectors.

Finally, as your system grows, your logging strategy must scale with it. A setup that works perfectly for a small development project may fall short when you're processing thousands of [API requests](https://blog.dreamfactory.com/rest-apis-for-government/) per minute in production. Continuously refining your logging configuration ensures that your system remains efficient, secure, and aligned with the principles outlined in this guide.

## FAQs

### What are the pros and cons of using the 'none' logging driver in high-performance Docker setups?

When it comes to high-demand Docker environments, the **'none' logging driver** offers a way to boost performance by completely eliminating logging overhead. By doing so, it frees up [system resources](https://wiki.dreamfactory.com/DreamFactory/Features/System_Resources) and allows containers to run more efficiently.

That said, there’s a significant trade-off: no logs are generated at all. This lack of log data makes it extremely difficult to troubleshoot issues, monitor activity, or conduct security audits. While this option prioritizes performance, it’s not a practical choice for setups where log visibility is a must.

### What are the best ways to keep my Docker log data secure during transmission and storage?

To ensure the security of your Docker log data, it's important to use **secure transmission protocols**. Opt for TCP over UDP, as it offers better reliability and safeguards your data during transmission. Additionally, enable **log rotation** to manage disk space effectively and minimize the chances of exposing sensitive information.

Use **Docker secrets** to handle sensitive data securely. This ensures that confidential information is only accessible to the containers that need it. Pair this with monitoring and logging tools to keep an eye on activities, spot unusual behavior, and address potential threats swiftly.

By adopting these measures, you can strengthen both the security and functionality of your Docker logging system.

### How can I audit and monitor my Docker logging setup to ensure efficiency and compliance?

To ensure your Docker logging setup runs smoothly, begin by confirming that your logging drivers are properly configured to meet your specific operational requirements. It's also important to set up **log rotation** and **retention policies** to avoid overwhelming your storage and to comply with any relevant regulations.

Centralized logging tools can be a game-changer - they allow you to gather logs in one place, monitor system activity, and quickly spot unusual behavior or potential security risks. Make it a habit to regularly review and analyze these logs. This helps you identify patterns, resolve issues efficiently, and keep your system secure and running at its best. By staying on top of these practices, you'll keep your logging setup dependable and avoid unnecessary surprises.

## Related Blog Posts

- [Ultimate Guide to API Audit Logging for Compliance](https://blog.dreamfactory.com/blog/ultimate-guide-to-api-audit-logging-for-compliance/)
- [DreamFactory Logging Features Explained](https://blog.dreamfactory.com/blog/dreamfactory-logging-features-explained/)
- [API Request Logging: Best Practices](https://blog.dreamfactory.com/blog/api-request-logging-best-practices/)
- [Best Practices for Analyzing Logs in Data Pipelines](https://blog.dreamfactory.com/blog/best-practices-for-analyzing-logs-in-data-pipelines/)

![Kevin Hood](https://blog.dreamfactory.com/hs-fs/hubfs/Imported%20sitepage%20images/T9J6AH3S5-U08J3CS0K7C-ef0996ecbb6c-512.jpg?width=100&height=100&name=T9J6AH3S5-U08J3CS0K7C-ef0996ecbb6c-512.jpg)

Kevin Hood

Kevin Hood is an accomplished solutions engineer specializing in data analytics and AI, enterprise data governance, data integration, and API-led initiatives.

 Stay Connected with   
 The Connector Newsletter!

 Subscribe to stay up-to-date with DreamFactory's latest product updates, API best practices, and tech humor in your inbox.

[![Dreamfactory Logo](https://blog.dreamfactory.com/hubfs/raw_assets/public/dreamfactory/images/megamenu/Megamenu-logo.svg)](https://www.dreamfactory.com/)

[Call Sales +1 (415) 993-5877](tel:+14159935877)

Open – Mon–Fri 9–5 PT

[FREE 30 Minute Demo](https://www.dreamfactory.com/demo)

#### Follow us

- [GitHub](https://github.com/dreamfactorysoftware/dreamfactory)
- [Facebook](https://www.facebook.com/dfsoftwareinc/)
- [X (Twitter)](https://twitter.com/dfsoftwareinc)
- [LinkedIn](https://www.linkedin.com/company/dreamfactory-software)
- [YouTube](https://www.youtube.com/c/dreamfactorysoftware)

### Features

[Features](https://www.dreamfactory.com/features) [Self hosted](https://www.dreamfactory.com/features#self) [API Generation](https://www.dreamfactory.com/features#api) [Security](https://www.dreamfactory.com/features#secure) [Customization](https://www.dreamfactory.com/features#custom) [Pricing](https://www.dreamfactory.com/pricing)

### Installers

[Linux](https://www.dreamfactory.com/features#installer) [Docker](https://www.dreamfactory.com/features#installer) [Kubernetes](https://www.dreamfactory.com/features#installer)

### API Resources

[Documentation](https://docs.dreamfactory.com/) [Case Studies](https://www.dreamfactory.com/stories) [White Papers](https://www.dreamfactory.com/resources/whitepapers) [Academy](https://www.dreamfactory.com/academy) [API Calculator](https://calculator.dreamfactory.com) [Open Source](https://github.com/dreamfactorysoftware)

### Company

[Blog](https://blog.dreamfactory.com/) [Hub](https://www.dreamfactory.com/hub) [About us](https://www.dreamfactory.com/about) [Partners](https://www.dreamfactory.com/partners) [Support](https://www.dreamfactory.com/support) [Connectors](https://www.dreamfactory.com/connectors) [Contact Us](https://www.dreamfactory.com/demo)

 © 2025 DreamFactory. All rights reserved.

[Terms of Use](https://www.dreamfactory.com/terms-of-use) [Privacy Policy](https://www.dreamfactory.com/privacy-policy) [LLMs](https://www.dreamfactory.com/llms.txt)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Kevin Hood",
    "url" : "https://blog.dreamfactory.com/author/kevin-hoo"
  },
  "dateModified" : "2025-10-16T17:00:00.440Z",
  "datePublished" : "2025-09-06T00:42:58.000Z",
  "headline" : "Best Practices for Docker Logging Configuration",
  "image" : [ "https://assets.seobotai.com/cdn-cgi/image/quality=75,w=1536,h=1024/dreamfactory.com/68bb7a4168bb5e38323cd66a-1757119451410.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.dreamfactory.com/best-practices-for-docker-logging-configuration",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.dreamfactory.com/hubfs/DreamFactory%20-%20Orange%20-%20Transparent-1.png"
    }
  }
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "FAQPage",
  "mainEntity" : [ {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "<p>When it comes to high-demand Docker environments, the <strong>'none' logging driver</strong> offers a way to boost performance by completely eliminating logging overhead. By doing so, it frees up <a href=\"https://wiki.dreamfactory.com/DreamFactory/Features/System_Resources\">system resources</a> and allows containers to run more efficiently.</p> <p>That said, there’s a significant trade-off: no logs are generated at all. This lack of log data makes it extremely difficult to troubleshoot issues, monitor activity, or conduct security audits. While this option prioritizes performance, it’s not a practical choice for setups where log visibility is a must.</p>"
    },
    "name" : "What are the pros and cons of using the 'none' logging driver in high-performance Docker setups?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "<p>To ensure the security of your Docker log data, it's important to use <strong>secure transmission protocols</strong>. Opt for TCP over UDP, as it offers better reliability and safeguards your data during transmission. Additionally, enable <strong>log rotation</strong> to manage disk space effectively and minimize the chances of exposing sensitive information.</p> <p>Use <strong>Docker secrets</strong> to handle sensitive data securely. This ensures that confidential information is only accessible to the containers that need it. Pair this with monitoring and logging tools to keep an eye on activities, spot unusual behavior, and address potential threats swiftly.</p> <p>By adopting these measures, you can strengthen both the security and functionality of your Docker logging system.</p>"
    },
    "name" : "What are the best ways to keep my Docker log data secure during transmission and storage?"
  }, {
    "@type" : "Question",
    "acceptedAnswer" : {
      "@type" : "Answer",
      "text" : "<p>To ensure your Docker logging setup runs smoothly, begin by confirming that your logging drivers are properly configured to meet your specific operational requirements. It's also important to set up <strong>log rotation</strong> and <strong>retention policies</strong> to avoid overwhelming your storage and to comply with any relevant regulations.</p> <p>Centralized logging tools can be a game-changer - they allow you to gather logs in one place, monitor system activity, and quickly spot unusual behavior or potential security risks. Make it a habit to regularly review and analyze these logs. This helps you identify patterns, resolve issues efficiently, and keep your system secure and running at its best. By staying on top of these practices, you'll keep your logging setup dependable and avoid unnecessary surprises.</p>"
    },
    "name" : "How can I audit and monitor my Docker logging setup to ensure efficiency and compliance?"
  } ]
}
```