Getting Started with Docker

Seq is a centralized log server for ingesting and querying structured log events. Your applications send structured events through a framework like ASP.NET Core logging or Serilog:

Seq is distributed for Linux as a Docker container. Docker is a lightweight platform for bundling applications and their platform dependencies as a single unit.

Running Seq in a Docker container

Seq is run using the officially supported datalust/seq container image from the Docker Store. An example of running Seq in a docker container as a shared background service is:

$ docker run \
  -d \
  --restart unless-stopped \
  --name seq \
  -e ACCEPT_EULA=Y \
  -v $HOST_PATH_TO_SEQ:/data \
  -p $HOST_HTTP_PORT:80 \
  datalust/seq:latest

where:

• $HOST_PATH_TO_SEQ is an absolute path on the container host for the Seq instance to use for configuration and event storage. The path needs to exist already, but may be empty. If the container is stopped a new one can be started using the same path.
• $HOST_HTTP_PORT is a port on the host to expose the Seq UI and web API on.

The container can then be stopped and started using the docker stop seq and docker start seq commands. It will be automatically started when the Docker daemon does unless it's been explicitly stopped.

Persistent volumes

The Seq Docker container stores configuration and log events in its /data directory. For this directory to survive container restarts, it needs to be mapped to a persistent volume using -v on the command-line, as in the example above.

Seq is a database; the volume provided to it should be equivalent to local disk storage, for example an Azure Disks VHD or an AWS EBS volume.

Only one running Seq container can access a storage volume concurrently: it's not possible to run two or more container instances pointing to the same storage.

🚧

Azure Files volumes

When running Seq on Microsoft Azure, Azure Disks volumes (mounted VHDs) are recommended for persistent storage. The SMB-based Azure Files standard volumes used with Azure Container Instances are not suitable for production workloads.

Enabling authentication

A local development instance that isn't exposed to the outside world might be fine without authentication on the UI and API. In most cases, though, your next step should be visiting Settings > Users and enabling authentication.

Ingesting log events

Before you can benefit from Seq, your applications need to be configured to send log events to it. Quick integrations into Serilog, ASP.NET Core, Node.js/Bunyan, and several other libraries are available: see the Inputs heading in the topics on the left-hand side of this page for a longer list.

Your applications can also log events by tailing their output with the seqcli command-line client

$ ./my-app | seqcli ingest

or posting JSON directly to Seq:

$ curl -XPOST "http://your-seq-host/api/events/raw?clef" \
  -d "{'@t':'2018-06-07T03:44:57.8532799Z','@mt':'Hello, {User}','User':'alice'}"

Containerized services can also forward their logs to Seq natively using Docker's GELF log driver.

Exposing the ingestion port from a container

Containers can expose the limited ingestion port in addition to or instead of the API port. In the container the ingestion port is mapped to 5341:

$ docker run \
  -e ACCEPT_EULA=Y \
  -v $HOST_PATH_TO_SEQ:/data \
  -p $HOST_HTTP_PORT:80 \
  -p $HOST_INGESTION_PORT:5341 \
  datalust/seq:latest

where:

• $HOST_PATH_TO_SEQ is an absolute path on the container host for the Seq instance to use.
• $HOST_INGESTION_PORT is a port on the host to expose the Seq ingestion endpoint on.

Running other Seq commands in a docker container

Any arguments specified after the datalust/seq:latest image in the docker run command will be passed as arguments to the Seq binary:

$ docker run \
  --rm \
  -e ACCEPT_EULA=Y \
  -v $HOST_PATH_TO_SEQ:/data \
  datalust/seq:latest version

where:

• $HOST_PATH_TO_SEQ is an absolute path on the container host for the Seq instance to use.

Container environment

File paths

Important file paths used by Seq in the container.

Ports

Important ports used by Seq in the container.

Environment variables

Environment variables used by Seq in the container.

Memory limits

For Seq to accurately measure available memory, depending on the hosting infrastructure, it's often necessary to specify memory limits for the container. If the Seq container exits unexpectedly, or fails with out-of-memory errors, specify the --memory and --memory-swap arguments to docker run:

docker run --memory=16g --memory-swap=16g <other args> datalust/seq

The argument to these flags is the total memory that the system should provide for the container (more is better). Normally, both flags should have the same value, effectively disabling swap for the container.

What's next?

Once your apps are happily sending events to Seq, you can:

• Learn about the flexible Seq query syntax
• Create some signals to provide quick access to different filters
• Set up some retention policies to control disk usage

Happy logging!