If the max-file value is set to 2, two files are created as shown below.
11111-json.log
11111-json.log.1But here, when the 11111-json.log file size is max-size, the contents of 11111-json.log are moved to 11111-json.log.1, and the size of 11111-json.log Becomes zero. /var/log/container At this point I lose the last log.
The log in the /var/log/container path eventually links to /var/lib/docker/containers/~, so if the file mentioned above works that way, the log will be lost.
How can't I be lost?
According to your settings, all logs .log.1, .log.2 are stored in /var/lib/docker/containers/... and as per docker documentation you can change those settings for docker in daemon.json:
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3",in /var/log/containers you can find link to the last created log file.
As per documentation for flunetd: You should consider using in_tail option:
in_tail is included in Fluentd's core. No additional installation process is required. When Fluentd is first configured with in_tail, it will start reading from the tail of that log, not the beginning. Once the log is rotated, Fluentd starts reading the new file from the beginning. It keeps track of the current inode number.
Please refer to the similar community post