<p>when i use docker as CRI:</p>
<pre><code>{&quot;log&quot;:&quot;I0421 14:23:18.944348       1 node.go:172] Successfully retrieved node IP: 192.168.49.2\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:18.944635198Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:18.944724       1 server_others.go:142] kube-proxy node IP is an IPv4 address (192.168.49.2), assume IPv4 operation\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:18.944838628Z&quot;}
{&quot;log&quot;:&quot;W0421 14:23:19.008388       1 server_others.go:578] Unknown proxy mode \&quot;\&quot;, assuming iptables proxy\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.008544314Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.008581       1 server_others.go:185] Using iptables Proxier.\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.008653777Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.008904       1 server.go:650] Version: v1.20.0\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.008963124Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.009762       1 config.go:315] Starting service config controller\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.009986673Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.009867       1 shared_informer.go:240] Waiting for caches to sync for service config\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.009999075Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.009973       1 config.go:224] Starting endpoint slice config controller\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.010041688Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.009979       1 shared_informer.go:240] Waiting for caches to sync for endpoint slice config\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.01004961Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.110110       1 shared_informer.go:247] Caches are synced for endpoint slice config \n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.110273306Z&quot;}
{&quot;log&quot;:&quot;I0421 14:23:19.110120       1 shared_informer.go:247] Caches are synced for service config \n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2023-04-21T14:23:19.110525274Z&quot;}
</code></pre>
<p>And</p>
<p>when i use containerd as CRI:</p>
<pre><code>2022-07-19T11:13:32.228206987+08:00 stderr F I0719 11:13:32.228176       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_max' to 524288
2022-07-19T11:13:32.228229469+08:00 stderr F I0719 11:13:32.228203       1 conntrack.go:52] Setting nf_conntrack_max to 524288
2022-07-19T11:13:32.228460095+08:00 stderr F I0719 11:13:32.228431       1 conntrack.go:83] Setting conntrack hashsize to 131072
2022-07-19T11:13:32.237601129+08:00 stderr F I0719 11:13:32.237568       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_tcp_timeout_established' to 86400
2022-07-19T11:13:32.237638594+08:00 stderr F I0719 11:13:32.237613       1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_tcp_timeout_close_wait' to 300
2022-07-19T11:13:32.237787689+08:00 stderr F I0719 11:13:32.237756       1 config.go:315] Starting service config controller
</code></pre>
<p>Any body know why the stream of log file is always stderr?</p>
<p>i expect that info messages is writing to stdout and err messages is writing to stderr.</p>

magiceses
<p>STDOUT is usually a command’s normal output, and STDERR is typically used to output error messages. By default, docker/container logs show the command’s STDOUT and STDERR. This information that is logged and the format of the log depends almost entirely on the container’s endpoint command. <em><strong>When you use docker/ container as CRI to write the logs in Json it shows the default as STDERR and this needs to be parsed before moving to the logging agent.</strong></em></p>
<p>Refer to this <a href="https://github.com/fluent/fluent-bit/issues/522" rel="nofollow noreferrer">GIT LINK</a> by stevenAcoffman for more information and here they used fluentbit as log parser.</p>
<p>You can also use <a href="https://sematext.com/docs/logagent/installation-docker/#kubernetes-with-containerd-and-ibm-cloud" rel="nofollow noreferrer">sematext</a> as a Log agent which supports CRI-O log format as well and install its <a href="https://sematext.com/docs/logagent/input-filter-containerd/" rel="nofollow noreferrer">Plugin</a> to parse the logs.</p>
<blockquote>
<p>By default, Docker captures the standard output (and standard error)
of all your containers, and writes them in files using the JSON
format. The JSON format annotates each line with its origin (stdout or
stderr) and its timestamp. Each log file contains information about
only one container. <code>{&quot;log&quot;:&quot;Log line is here\n&quot;,&quot;stream&quot;:&quot;stdout&quot;,&quot;time&quot;:&quot;2019-01-01T11:11:11.111111111Z&quot;}</code></p>
</blockquote>
<p>Along with the above, you need to install <a href="https://docs.docker.com/config/containers/logging/json-file/" rel="nofollow noreferrer">JSON Logging file driver</a></p>
