- Docker logs tail: Troubleshoot Docker containers with real-time logging - Wed, Sep 13 2023
- dsregcmd: Troubleshoot and manage Azure Active Directory (Microsoft Entra ID) joined devices - Thu, Aug 31 2023
- Ten sed command examples - Wed, Aug 23 2023
Troubleshooting and examining the Docker containerized environment requires understanding how to use the docker logs command. The command provides many parameters to help pinpoint issues, verify the environment, and monitor specific containers.
You can issue the docker logs --help command to view the parameters.
Viewing the docker logs command parameters
Viewing Docker logs
If you create a container and want to see its latest logs, you need to know the container name or ID, and then pass this to the docker logs command. To get the container names and IDs, we use another command:
docker ps
Viewing containers running in the environment with docker ps
Now that we have a list of the Docker container names and IDs, we can pass either one to the docker logs command to view the logs for that particular container.
docker logs <container ID or name>
As shown below, when we execute the command, it returns to the bash prompt. So, we can't see any new logs created after the command is executed.
Viewing logs for an Nginx container running in Docker
Docker logs tail
If you want to see and monitor a specific container for new logs, you can do that with the "-f" parameter. This parameter is the "follow" parameter and tells Docker that we want to follow the log output for new log entries. It provides the functionality that many think of as "tailing" logs.
docker logs <container ID or name> -f
As shown below, when you use the -f parameter, you are not returned to the terminal prompt. Instead, the output stays "live" until you break from the command with CTRL+C. Below, you can see in the logs where we connected to the Nginx container with a client. This log entry happened after we initiated the docker logs command with the -f parameter.
Viewing Docker log timestamps
By default, when Docker returns the entries from the logs, you won't see the timestamps for all entries. We can use another command to view the timestamps in the Docker logs, which we can use with other parameters that we will see below. That is the "-t" parameter.
docker logs <container ID or name> -t
Viewing the docker logs timestamps
Finding logs since a specific or relative time
Another excellent parameter with the docker logs command allows for finding logs since a specific or relative time. This functionality is helpful if you know that an error or container crash happened within the last 30 or 60 minutes. You can view only the logs since that time. To use the timestamp, you can use the "-t" parameter described above to get the timestamps for all log entries and then pass this to the "--since" parameter.
docker logs <container ID or name> --since <timestamp or relative time>
We can also use the "relative" time, which is a bit easier for most and doesn't require getting timestamps, etc. Below, you can see I first queried "30 minutes ago," and nothing was displayed. However, adding 5 minutes to the relative time returned the logs of the client connection made to the Nginx container. Notice how we don't see any additional logs displayed. This is because we only see the logs created since 35 minutes ago. The other entries happened before then.
Using the since parameter to find logs since a specific or relative time
You can also combine the since and follow parameters to follow the logs since a specific time period.
Docker logs <container name or ID> --since -f
So, below, we see the logs created since the specified relative time, and we are tailing the output so we will see any new entries that are created.
Combining the since and follow parameters
Display logs until a specified time
We can also view Docker logs from the opposite point of view. We can get logs before a specific timestamp or relative time. To do so, we use the "--until" parameter.
docker logs <container name or ID> --until <timestamp or relative time>
Below, we get the timestamps so we can filter using the --until parameter with a timestamp. Once we pass the timestamp, we see only the log entries that happened until the timestamp.
docker logs nginx -t docker logs nginx --until 2023-08-27T18:30:00.893455245Z
Getting logs that happened before a specific timestamp or relative time
Display only a specific number of Docker log entries
If you want to view a specific number of Docker log entries, the docker logs -n parameter allows returning only the specified number of recent log entries, counting from the most recent entry.
docker logs nginx -n 1
Returning the specified number of lines from a Docker container log
Using Docker logs for troubleshooting
When troubleshooting Docker containers, the first place you should look at is the Docker logs for the container. For instance, if you start a container that should remain running, but you find that it exited, the logs can give insights into the reason why it exited.
Below, we view all containers, even those that are stopped, using the following command:
docker ps -a
We can see that the nginx container has exited on the Docker host. Why?
Viewing an exited Docker container with docker ps a
Let's pull the Docker logs for the container.
docker logs nginx
The Docker logs show why the Nginx container failed to start. There is an issue with mounting the nginx.conf file. Without the insights provided by Docker logs, you wouldn't know where to start troubleshooting.
Docker logs show the reason why the Nginx container failed to start
Using grep with Docker logs
You can also use grep in combination with Docker logs to search for keywords, error messages, etc. For instance, with the failed Nginx container, we can search for keywords like error, failed, etc., using grep.
docker logs nginx | grep "failed"
As we can see below, using grep displays only the Docker logs with that keyword. The word is highlighted, which helps errors stand out.
Using grep in combination with Docker logs
Debugging the Docker daemon
There may be times when you need to view debug logging for the Docker daemon when troubleshooting to understand if there is an underlying issue with the Docker daemon itself.
First, you need to enable debug logging in Docker. To do so, edit the daemon.json file located here:
/etc/docker/daemon.json
If it doesn't exist, create it. After that, edit the file, and enter the following:
{
"debug": true
}
Once you have the daemon.json file in place, you can restart the Docker service with the following command:
sudo service docker restart
Then, you can view the Docker daemon logs with the following command:
Subscribe to 4sysops newsletter!
##as root journalctl -u docker.service ##as sudo sudo journalctl -u docker.service
Viewing Docker daemon logs
Wrapping up
Viewing Docker logs is an essential skill for IT admins managing containerized environments running in Docker. The docker logs command has several parameters that can be used to view specific log entries and find the information needed to troubleshoot containers. As shown, you can easily use the docker logs command in conjunction with grep to find specific log messages in the output, and you can enable Docker daemon debug logging to troubleshoot the Docker daemon.
