docker日誌出現沒法檢索問題

平常檢查服務的時候，從portainer那裏進去看容器日誌的時候，發現右上角出現紅色的感嘆號：Unable to retrieve container logs。

由於以前沒出現過這樣的問題，因此就先上服務器上用命令docker logs -f containerID看日誌，發現日誌也是動不了，仍是停留在某個時間的日誌記錄上。

想了一下不該該是服務的日誌打印出問題，先照着Google搜索了一遍，發現都沒有跟個人問題相匹配的。由於日誌有時能收集顯示，有些日誌不能夠，應該是跟docker設置的日誌引擎有問題。

原本是想整一套EFK的，可是感受如今日誌量還不夠大，因此並無修改docker的日誌引擎，仍是默認的journald

[root@ad-official xiaoxiao]# docker info|grep Logging
  WARNING: You're not using the default seccomp profile
Logging Driver: journald

journald的官方文檔上有這麼一個說明：

man journald.conf ... RateLimitInterval=, RateLimitBurst= Configures the rate limiting that is applied to all messages generated on the system. If, in the time interval defined by RateLimitInterval=, more messages than specified in RateLimitBurst= are logged by a service, all further messages within the interval are dropped until the interval is over. A message about the number of dropped messages is generated. This rate limiting is applied per-service, so that two services which log do not interfere with each other's limits. Defaults to 1000 messages in 30s. The time specification for RateLimitInterval= may be specified in the following units: "s", "min", "h", "ms", "us". To turn off any kind of rate limiting, set either value to 0. ...

這裏寫了默認30秒內只能接收1000條日誌，看到這裏就能明白了，由於前陣子剛在docker發佈了一個單日日誌文件大小差很少達到3G的服務，致使到了其餘服務的日誌也受到了影響，大量的日誌被journald丟棄，因此咱們修改一下配置就沒有問題了。

打開/etc/systemd/journald.conf文件，將RateLimitBurst從默認的1000修改爲5000，根據本身目前的日誌輸出量進行調整：

[root@ad-official log]# cat /etc/systemd/journald.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitInterval=30s
RateLimitBurst=5000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#MaxRetentionSec=
#MaxFileSec=1month
ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
ForwardToWall=no
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

順便將ForwardToSyslog和ForwardToWall設置成no，由於默認是yes，會致使咱們清理了journal的日誌文件，而Syslog中的沒有清除掉，慢慢的就會將磁盤佔滿。

而後重啓一下journald就能夠恢復正常使用啦：systemctl restart systemd-journald.service