Container Logging & Monitoring Cheat Sheet

Updated 2026-05-25

Next Topic: Container Management Cheat Sheet

Container logging and monitoring encompasses the practices, tools, and patterns for collecting, aggregating, and analyzing logs, metrics, and traces from containerized applications running in Docker, Kubernetes, and orchestrated environments. Unlike traditional monolithic applications where logs and metrics reside on persistent hosts, containers are ephemeral and stateless — they start, stop, and restart frequently, making centralized collection essential. Modern container observability relies on stdout/stderr streams as the standard output mechanism, log drivers to route data, health probes to ensure availability, and metrics exporters to track resource consumption. Understanding this ecosystem is critical because improper logging configuration can lead to disk exhaustion, lost diagnostics during crashes, and inability to trace requests across distributed microservices.

What This Cheat Sheet Covers

This topic spans 17 focused tables and 159 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Container Log Output StreamsTable 2: Docker Log DriversTable 3: Docker Logging CommandsTable 4: Kubernetes Log Access with kubectlTable 5: Log Rotation and Retention PoliciesTable 6: Structured and JSON LoggingTable 7: Centralized Log Aggregation StacksTable 8: Log Shippers and ForwardersTable 9: Log Metadata Enrichment and LabelingTable 10: Kubernetes Audit LoggingTable 11: Container Health Checks and ProbesTable 12: Container Metrics Collection ToolsTable 13: Observability Platforms and Monitoring ToolsTable 14: Distributed Tracing for ContainersTable 15: eBPF Observability ToolsTable 16: Cloud Provider Logging & Monitoring SolutionsTable 17: Advanced Logging Patterns and Techniques

Table 1: Container Log Output Streams

The standard contract for container logging is simple: write everything to stdout and stderr, and let the platform handle collection. Understanding how the container runtime captures, stores, and exposes these streams — including the CRI log format used by modern runtimes like containerd — is the foundation for every other logging decision.

Concept	Example	Description
stdout	`echo "Request processed" > /dev/stdout`	• Standard output stream where applications write normal log messages • captured automatically by the container runtime.
stderr	`echo "Error occurred" >&2`	• Standard error stream for error and warning messages • also captured by runtime and often displayed separately in log tools.
12-factor app logging	`console.log("msg")` writes to stdout	• Treats logs as event streams written to stdout/stderr • no file management inside containers — the platform collects them.
JSON structured output	`{"level":"info","msg":"user_login","user_id":12}`	Writing key-value JSON to stdout enables parsing and indexing by log aggregators without custom regex.

Table 1: Container Log Output Streams

Concept	Example	Description
stdout	`echo "Request processed" > /dev/stdout`	• Standard output stream where applications write normal log messages • captured automatically by the container runtime.
stderr	`echo "Error occurred" >&2`	• Standard error stream for error and warning messages • also captured by runtime and often displayed separately in log tools.
12-factor app logging	`console.log("msg")` writes to stdout	• Treats logs as event streams written to stdout/stderr • no file management inside containers — the platform collects them.
JSON structured output	`{"level":"info","msg":"user_login","user_id":12}`	Writing key-value JSON to stdout enables parsing and indexing by log aggregators without custom regex.