I'm deploying a 3rd-party application in compliance with the 12 factor advisory, and one of the points tell that application logs should be printed to stdout/stderr: then clustering software can collect it.

However, the application can only write to files or syslog. How do I print these logs instead?

  • They are already going to syslog. You can just pick them up from there! – Michael Hampton May 28 '14 at 14:24
  • @MichaelHampton, seems fine, but Docker runs a single process that can write to stdout, and this sounds like combining two of them? – kolypto May 28 '14 at 14:56
  • 1
    You can have a daemon process use syslog and have a front process which prints? – qkrijger May 28 '14 at 16:59
  • @qkrijger, good point! Now, if anyone has experience with it ... ? – kolypto May 28 '14 at 17:10
up vote 91 down vote accepted

An amazing recipe is given in the nginx Dockerfile:

# forward request and error logs to docker log collector
RUN ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log

Simply, the app can continue writing to it as a file, but as a result the lines will go to stdout & stderr!

  • 1
    This. Is. Just. Brilliant. And versatile. – spacediver Nov 15 '14 at 23:24
  • 8
    The one thing that's a problem with this is when the thing you're running insists on forking itself to the background as a non-root process. I'm having this with squid3, and it then has trouble with permissions on /dev/stdout. – mikepurvis Dec 17 '14 at 3:51
  • 3
    This doesn't always work - for example if the application attempts to seek the file, this method will generally not work. – mixja May 24 '16 at 11:45
  • Link is down... – Babken Vardanyan Jun 20 '17 at 10:23
  • 2
    Everything is a file for the win. – RubberDuck Jul 15 '17 at 20:12

In another question, Kill child process when the parent exits, I got the response that helped to sort this out.

This way, we configure the application so it logs to a file, and continuously tail -f it. Luckily, tail can accept --pid PID: it will exit when the specified process exits. We put $$ there: PID of the current shell.

As a final step, the launched application is exec'ed, which means that the current shell is completely replaced with that application.

Runner script, run.sh, will look like this:

#! /usr/bin/env bash
set -eu

rm -rf /var/log/my-application.log
tail --pid $$ -F /var/log/my-application.log &

exec /path/to/my-application --logfile /var/log/my-application.log

NOTE: by using tail -F we list filenames, and it will read them even if they appear later!

Finally, the minimalistic Dockerfile:

FROM ubuntu
ADD run.sh /root/run.sh
CMD ['/root/run.sh']

Note: to workaroung some extremely strange tail -f behavior (which says "has been replaced with a remote file. giving up on this name") i tried another approach: all known log files are created & truncated on start up: this way I ensure they exist, and only then -- tail them:

#! /usr/bin/env bash
set -eu


( umask 0 && truncate -s0 $LOGS/http.{access,error}.log )
tail --pid $$ -n0 -F $LOGS/* &

exec /usr/sbin/apache2 -DFOREGROUND

for nginx you can have nginx.conf pointing to /dev/stderr and /dev/stdout like this

user  nginx;
worker_processes  4;
error_log  /dev/stderr;
http {
    access_log  /dev/stdout  main;

and your Dockerfile entry should be

/usr/sbin/nginx -g 'daemon off;'

For a background process in a docker container, e.g. connecting with exec to /bin/bash I was able to use.

echo "test log1" >> /proc/1/fd/1

This sends the output to the stdout of pid 1, which is the one docker pickups up.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.