Working with Docker Logging

1. Viewing Container Logs (docker logs)

Option	Values	Description
docker logs <container>	`docker logs my-container`	View the logs of a running or stopped container
docker logs -f	`docker logs -f my-container`	Follow the log output in real-time (like `tail -f`)
docker logs --since	`docker logs --since "2024-01-01T00:00:00Z" my-container`	Display logs since a specific timestamp or duration (e.g., `--since 1h`)
docker logs --until	`docker logs --until "2024-01-02T00:00:00Z" my-container`	Display logs until a specific timestamp or duration
docker logs --tail	`docker logs --tail 50 my-container`	Show only the last N lines of logs
docker logs --details	`docker logs --details my-container`	Show detailed log information including timestamps and stream type
docker logs --timestamps	`docker logs --timestamps my-container`	Include timestamps in each log line

Example: Viewing logs with timestamps and limited output

docker logs --timestamps --tail 20 my-app-container

Example: Following logs in real-time

docker logs -f my-app-container

Note: Logs are stored in a container's filesystem and may be lost if the container is removed. Consider using external logging drivers like fluentd or syslog for persistent logging.

2. Following Logs in Real-Time

Option	Values	Description
docker logs -f	`docker logs -f <container>`	Follow log output in real-time
docker logs --follow	`docker logs --follow <container>`	Alias for `-f`
docker logs -t	`docker logs -t <container>`	Include timestamps in output
docker logs --since	`docker logs --since "2024-01-01T00:00:00"`	Show logs since a specific time
docker logs --until	`docker logs --until "2024-01-02T00:00:00"`	Show logs until a specific time

Example: Follow logs with timestamps

docker logs -f -t my-container

Example: Follow logs since a specific time

docker logs -f --since "2024-01-01T00:00:00" my-container

Note: The -f flag keeps the command running and outputs new log lines as they are generated. Use Ctrl+C to stop following logs.

3. Limiting Log Output (--tail, --since)

Option	Description	Usage
--tail	Limits the number of lines of recent logs to display	`docker logs --tail 100 container_name`
--since	Shows logs only from a specific time or duration	`docker logs --since 1h container_name`

Example: Viewing Recent Logs

docker logs --tail 50 my_container

Example: Filtering Logs by Time

docker logs --since 2024-01-01T00:00:00Z my_container

4. Configuring Logging Drivers

Driver	Description	Usage	Notes
json-file	Default driver storing logs in JSON format	`--log-driver=json-file`	Logs stored in `/var/lib/docker/containers/<container-id>/<container-id>-json.log`
syslog	Sends logs to syslog daemon	`--log-driver=syslog`	Requires syslog daemon running on host
journald	Logs to systemd journal	`--log-driver=journald`	Works with systemd-based systems
gelf	Logs to Graylog Extended Log Format (GELF) endpoint	`--log-driver=gelf`	Requires GELF-compatible logging server
fluentd	Logs to Fluentd collector	`--log-driver=fluentd`	Requires Fluentd daemon running
awslogs	Logs to Amazon CloudWatch Logs	`--log-driver=awslogs`	Requires AWS credentials and CloudWatch Logs permissions
splunk	Logs to Splunk Enterprise or Splunk Cloud	`--log-driver=splunk`	Requires Splunk HTTP Event Collector (HEC) endpoint
none	Disables logging for container	`--log-driver=none`	No logs are captured or sent

Example: Setting logging driver for a container

docker run --log-driver=syslog --log-opt syslog-address=udp://localhost:514 nginx

Example: Setting logging driver for a service (Swarm mode)

docker service create --log-driver=gelf --log-opt gelf-address=udp://localhost:12201 myapp

Note: The json-file driver is the default logging driver for Docker containers. It stores logs in JSON format with timestamps and log levels.

Warning: When using syslog or journald, ensure that the logging daemon is running and accessible from the Docker host to avoid log loss.

5. Using JSON File Driver

Option	Values	Notes
log-driver	`json-file`	Default logging driver for Docker containers
log-opt.max-size	`10m`	Maximum size of log file before rotation (default: 10MB)
log-opt.max-file	`3`	Number of log files to retain (default: 5)

Example: Run container with JSON logging

docker run --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  nginx

Note: JSON logs are stored in /var/lib/docker/containers/<container-id>/<container-id>-json.log on the host.

6. Using Syslog Driver

Option	Values	Description
syslog-address	`tcp://localhost:514`	Address of the syslog server (e.g., `tcp://localhost:514`, `udp://syslog.example.com:514`)
syslog-facility	`local0`	Syslog facility to use (e.g., `local0`, `user`, `daemon`)
syslog-tag	`docker`	Tag to use for syslog messages (e.g., `docker`, custom tag)

Example: Configure Docker to use Syslog Driver

docker run --log-driver=syslog \
  --log-opt syslog-address=udp://localhost:514 \
  --log-opt syslog-facility=local0 \
  --log-opt syslog-tag=docker-app \
  nginx

Note: The syslog driver requires the syslog server to be accessible from the Docker host.

7. Using Journald Driver

Option	Values	Notes
--log-driver	`journald`	Set the logging driver to journald
--log-opt	`syslog.facility=local0`	Specify syslog facility for journald logs
--log-opt	`syslog.tag=container-name`	Set tag for journald entries

Example: Run container with journald logging

docker run --log-driver=journald --log-opt syslog.tag=myapp nginx

Note: The journald driver requires the systemd logging backend. Ensure your host system supports journald logging.

Warning: Journald logs are not directly accessible via docker logs. Use journalctl to view logs.

8. Configuring Log Options

Option	Description	Default Value	Notes
--log-driver	Specifies the logging driver to use for container logs	`json-file`	Available drivers: `json-file`, `syslog`, `journald`, `gelf`, `fluentd`, `awslogs`, `gcplogs`, `none`
--log-opt	Set options for the logging driver		Can be specified multiple times. Format: `key=value`

Example: Configure JSON log driver with max size and rotation

docker run --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  nginx

Example: Use syslog driver with custom facility

docker run --log-driver syslog \
  --log-opt syslog-facility=local7 \
  --log-opt tag=nginx-container \
  nginx

Example: Use GELF driver for Graylog

docker run --log-driver gelf \
  --log-opt gelf-address=udp://graylog.example.com:12201 \
  --log-opt tag=nginx \
  nginx

Note: The json-file driver is the default logging driver. It stores logs in JSON format within the container's directory.

Warning: When using syslog or other external logging drivers, ensure the logging system is configured to handle the log volume to avoid performance issues.

9. Setting Log Rotation

Option	Values	Description
--log-driver	`json-file`	Driver to use for container logs
--log-opt	`max-size=10m`	Maximum size of log file before rotation
--log-opt	`max-file=3`	Number of log files to keep after rotation

Example: Configure log rotation for a container

docker run --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  nginx

Note: The json-file driver is the default logging driver in Docker.

10. Viewing Logs from Multiple Containers

Command	Description	Example
docker logs	View logs from a single container	`docker logs my-container`
docker logs -f	Follow logs in real-time	`docker logs -f my-container`
docker logs --since	View logs since a specific time	`docker logs --since 2024-01-01T00:00:00 my-container`
docker logs --tail	View last N lines of logs	`docker logs --tail 100 my-container`
docker logs --details	Include extra details in logs	`docker logs --details my-container`

Example: Viewing logs from multiple containers

docker logs --details --since 2024-01-01T00:00:00 --tail 50 container1 container2

Example: Following logs from multiple containers

docker logs -f container1 container2

Note: The --details flag is only available for the json-file logging driver.

Warning: Using docker logs -f on containers with high log volume can lead to performance issues.

11. Filtering Logs by Timestamp

Filter Type	Description	Example
--since	Display logs since a specific timestamp or duration	`docker logs --since "2024-01-01T00:00:00Z" container_name`
--until	Display logs until a specific timestamp or duration	`docker logs --until "2024-01-02T00:00:00Z" container_name`
--since and --until together	Combine both to filter logs within a time range	`docker logs --since "2024-01-01T00:00:00Z" --until "2024-01-02T00:00:00Z" container_name`

Example: Filtering Logs by Timestamp

docker logs --since "2024-01-01T00:00:00Z" --until "2024-01-02T00:00:00Z" my_container

Note: Timestamps must be in RFC3339 format (e.g., 2024-01-01T00:00:00Z) or relative durations (e.g., 1h, 30m, 10s).

12. Disabling Logging

Option	Description	Notes
--log-driver	`none`	Disables logging for the container

Example: Disable logging for a container

docker run --log-driver=none nginx

Note: Disabling logging may impact debugging and monitoring capabilities.