Sitecore 10 on Containers use the Windows Container Tools by default for logging. This is configured through a json file which is located in C:\LogMonitor\logmonitorconfig.json. It will look something like below:

{
  "LogConfig": {
    "sources": [
      {
        "type": "EventLog",
        "startAtOldestRecord": false,
        "eventFormatMultiLine": false,
        "channels": [
          {
            "name": "system",
            "level": "Error"
          }
        ]
      },
      {
        "type": "File",
        "directory": "c:\\inetpub\\logs",
        "filter": "*.log",
        "includeSubdirectories": true
      },
      {
        "type": "File",
        "directory": "c:\\inetpub\\wwwroot\\App_data\\logs",
        "filter": "log.*",
        "includeSubdirectories": false
      }
    ]
  }
}

This configuration ensures the logs get send to STDOUT and the logging driver can pick up the logs from there. Docker support several logging drivers, a full list can be found on their site.

Logs getting lost intermittently

This works well initially and logs will be collected properly by the logging solution. However at scale logs might get lost intermittently, in some cases a significant percentage of logs will be lost. Sitecore uses a rolling style of logging, which is not properly supported by the Windows Container Tools. There is an issue created on their Github Repo here but it has received little attention so far.

One potential workaround is to configure a large maximumFileSize in Sitecore’s logging configuration. In some cases this can prevent the issue completely if the log does not need to rollover. At scale this will at best mitigate the issue but it will not address the root cause.

Solution; mount logs directly on the host

The only fix that I’m aware of is to mount the log folder on the host to prevent the issue described above. If anyone else found a better solution please let me know in the comments section below. Docker provides good documentation on how a volume should be mounted which can be found here. Below is some sample code to mount the volume, this needs to be specified using Windows filename semantics without a leading slash, and the destination log directory needs to be empty:

docker run -v c:\logs:c:\inetpub\wwwroot\App_data\logs ...

One thing to keep in mind here is that the host can potentially run multiple containers which share the same log folder on the host. One potential workaround would be to have a separate folder for each container but the best solution will be different depending on many factors.