Docker Logs: What They Are and How to Use Them (with Examples)

Life would be much simpler if applications running inside Docker containers always behaved correctly. When things inevitably start going wrong, you need diagnostic information to determine how and why.

If you are a system administrator responsible for building and managing containerized applications, docker logging is one of the most important things for you.

Dealing with the logs is one of the best ways to help reveal errors, aid in debugging, and optimize your application’s performance. So, let’s get started.

What Are Docker Logs

First, you need to understand how logs are generated.

In a nutshell, Docker logs are the console output of running containers. They provide the stdout (standard output) and stderr (standard error) streams of processes that run inside a container.

In a container, Docker watches stdout and stderr and collects the output from the streams, which is the container logs’ source.

Logging in Docker isn’t the same as logging elsewhere. In Docker, everything written to stdout and stderr streams is implicitly sent to a logging driver, which provides a mechanism to access these streams and send the logs to a file.

The default driver for Docker logs is “json-file,” which writes the logs to local files on the Docker host in JSON format.

Any logs stored in the container will be deleted when terminated or shut down.

The example below shows JSON logs created using the json-file driver:

{"log":"Adding password for user webdav\n","stream":"stderr","time":"2021-08-01T15:58:05.329724917Z"}Code language: JSON / JSON with Comments (json)

You can use the following command to find the current default logging driver:

docker info --format '{{.LoggingDriver}}'Code language: JavaScript (javascript)

json-file

Where Are Docker Logs Stored

If you use the default log format, JSON, a container’s logs can be found in the /var/lib/docker/containers/ directory on a Linux Docker host.

/var/lib/docker/containers/<container-id>/<container-id>-json.logCode language: HTML, XML (xml)

In the path shown above, the “<container-id>” is the id of the running container. If you’re unsure which id is related to which container, you can run the docker container ls command to list all running containers.

docker container ls

CONTAINER ID   IMAGE                          COMMAND                  CREATED          STATUS          PORTS                                NAMES
99e9b6f4b1a3   jbbodart/alpine-nginx-webdav   "/bin/sh -c '/entryp…"   51 minutes ago   Up 51 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp    webdavCode language: JavaScript (javascript)

How to View Docker Logs

Let’s say you were running a container and want to access the Docker logs for this container. How can you accomplish this task?

First, you can use the following command to check for currently running containers:

docker container ls

CONTAINER ID   IMAGE                          COMMAND                  CREATED          STATUS          PORTS                                NAMES
99e9b6f4b1a3   jbbodart/alpine-nginx-webdav   "/bin/sh -c '/entryp…"   58 minutes ago   Up 58 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp    webdavCode language: JavaScript (javascript)

This command prints a list of running containers. The most important parameter in our case is the CONTAINER ID, which we will use in the next step.

Now that you are sure your container is running, let’s use the CONTAINER ID to see all its logs.

View Docker Logs

To query container logs, use the docker logs command. It shows all the information in running container logs. With docker logs CONTAINER_ID, you can see all the logs broadcast by a specific container identified by a unique ID.

docker logs 99e9b6f4b1a3

172.17.0.1 - webdav [01/Aug/2021:18:38:39 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://localhost/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"
2021/08/01 18:39:09 [info] 10#10: *3 client 172.17.0.1 closed keepalive connection
172.17.0.1 - webdav [01/Aug/2021:18:39:09 +0000] "PUT /docker-logs.png HTTP/1.1" 201 25 "-" "curl/7.78.0"Code language: PHP (php)

How to Follow the Container Log

Although this will show you the logs, it won’t allow you to view continuous log output. Instead, using the -f flag will follow the Docker container logs.

docker logs -f 99e9b6f4b1a3

Display Only the Latest Lines

Sometimes, you want to quickly verify only your container’s latest 10 log rows. You can use the --tail option to specify the number of logs you want to see.

docker logs --tail 10 99e9b6f4b1a3

View Logs Since a Specific Date

When inspecting your Docker logs, you often want to limit the output to a given number of lines so that you do not become flooded with information.

If you want to see the logs from a specific point in time until now, the --since option helps with this task.

For example, to see container logs for the last 20 minutes, you would write:

docker logs --since 20m 99e9b6f4b1a3

You can also write a date format as long as it is provided in ISO format:

docker logs --since 2021-07-19T10:00:00 99e9b6f4b1a3Code language: CSS (css)

View Logs Until a Specific Date

To view logs until a specific date, use the --until option with a date or a duration.

docker logs --until 20m 99e9b6f4b1a3

You can also provide a date format like you did before for the --since option.

docker logs --until 2021-07-19T10:00:00 99e9b6f4b1a3Code language: CSS (css)

Conclusion

Docker logs help you debug and troubleshoot issues faster. In this tutorial, you learned what they are, how they can be inspected, and how to use options to monitor them.

If you have any questions or feedback, feel free to comment.