Docker Logs: What They Are and How to Use Them (with Examples)

In this article, we will show you everything you need to know about Docker logs and how to work with them.

Life would be much simpler if applications running inside Docker containers always behaved correctly. When things inevitably start going wrong, you need diagnostic information to determine how and why.

If you are a system administrator and responsible for building and managing containerized applications, docker logging is one of the most important for you. Dealing with the logs are is of the best ways to help reveal errors, aid in debugging, and optimize your application’s performance.

Related: What is Docker Container: An Introductory Guide for Beginners

So let’s dive into Docker logging and its log files.

What Are Docker Logs

First, you need to understand how logs are generated.

In a nutshell, Docker logs are the console output of running containers. They provide the stdout (standard output) and stderr (standard error) streams of processes that run inside a container.

In a container, Docker watches stdout and stderr and collects the output from the streams, which is the container logs’ source.

Related: Install Docker on Ubuntu: A Step-by-Step Guide

Logging in Docker isn’t the same as logging elsewhere. In Docker, everything written to stdout and stderr streams is implicitly sent to a logging driver, which provides a mechanism to access these streams and send the logs to a file.

The default driver for Docker logs is “json-file,” which writes the logs to local files on the Docker host in JSON format.

Any logs stored in the container will be deleted when terminated or shut down.

The example below shows JSON logs created using the json-file driver:

{"log":"Adding password for user webdav\n","stream":"stderr","time":"2021-08-01T15:58:05.329724917Z"}

You can use the following command to find the current default logging driver:

docker info --format '{{.LoggingDriver}}'

json-file

Where Are Docker Logs Stored

If you use the default log format, JSON, a container’s logs can be found in the /var/lib/docker/containers/ directory on a Linux Docker host.

/var/lib/docker/containers/<container-id>/<container-id>-json.log

In the path shown above, the <container-id> is the id of the running container. If you’re unsure which id is related to which container, you can run the docker container ls command to list all running containers.

docker container ls

CONTAINER ID   IMAGE                          COMMAND                  CREATED          STATUS          PORTS                                NAMES
99e9b6f4b1a3   jbbodart/alpine-nginx-webdav   "/bin/sh -c '/entryp…"   51 minutes ago   Up 51 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp    webdav

How to View Docker Logs

Let’s say you were running a container and want to access the Docker logs for this container. How can you accomplish this task?

First, you can use the following command to check for currently running containers:

docker container ls

CONTAINER ID   IMAGE                          COMMAND                  CREATED          STATUS          PORTS                                NAMES
99e9b6f4b1a3   jbbodart/alpine-nginx-webdav   "/bin/sh -c '/entryp…"   58 minutes ago   Up 58 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp    webdav

This command prints a list of running containers. In our case, the most important parameter is the CONTAINER ID, which we will use in the next step.

Now that you are sure your container is running let’s use the CONTAINER ID to see all its logs.

View Docker Logs

To query container logs, use the docker logs command. It is a command that shows all the information logged by a running container. With docker logs CONTAINER_ID, you can see all the logs broadcast by a specific container identified by a unique ID.

docker logs 99e9b6f4b1a3

172.17.0.1 - webdav [01/Aug/2021:18:38:39 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://localhost/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"
2021/08/01 18:39:09 [info] 10#10: *3 client 172.17.0.1 closed keepalive connection
172.17.0.1 - webdav [01/Aug/2021:18:39:09 +0000] "PUT /docker-logs.png HTTP/1.1" 201 25 "-" "curl/7.78.0"

How to Follow the Container Log

Although this will show you the logs, it won’t allow you to view continuous log output. Instead, using the -f flag will follow the Docker container logs.

docker logs -f 99e9b6f4b1a3

Display Only the Latest Lines

In some cases, you want to verify only your container’s latest 10 log rows quickly. You can use the --tail option to specify the number of logs you want to see.

docker logs --tail 10 99e9b6f4b1a3

View Logs Since a Specific Date

When you inspect your Docker logs, you often want to limit the output to a given number of lines, not to be flooded with information.

If you want to see the logs from a specific point in time until now, the --since option helps with this task.

For example, to see container logs for the last 20 minutes, you would write:

docker logs --since 20m 99e9b6f4b1a3

You can also write a date format as long as it is provided in ISO format:

docker logs --since 2021-07-19T10:00:00 99e9b6f4b1a3

View Logs Until a Specific Date

To view logs until a specific date, use the --until option with a date or a duration.

docker logs --until 20m 99e9b6f4b1a3

Or you can also provide a date format like you did before for the --since option.

docker logs --until 2021-07-19T10:00:00 99e9b6f4b1a3

Conclusion

Docker logs help you to debug and troubleshoot issues faster. In this tutorial, you learned what they are and how they can be inspected and use options to monitor them.

If you have any questions or feedback, feel free to leave a comment.