Docker container logs
Hem / Teknik & Digitalt / Docker container logs
To see the list of running containers, use this command:
This command shows a list of active containers along with their IDs, names, status, and other useful information.
In the example above, Docker is running two containers: openwebui and ollama. The easiest way to get started with SigNoz is SigNoz cloud.
You can open these files directly or use the command to view them in the terminal.
These logs contain application messages, warnings, and errors that help you debug problems. You can use , , , or specific timestamps like .
Adds RFC3339 timestamps to each log entry, helping you correlate log events with specific times when debugging issues.
Shows the last 100 log entries from the past hour, then continues following new logs.
However, these logs won't appear in and will be lost when the container is removed.
Logs from stopped containers
Docker preserves logs from stopped containers, which is crucial for debugging crashed applications:
Even after a container stops or crashes, Docker retains its logs until you explicitly remove the container. Anything written to a file (like ) won’t show up in .
Output from isn’t captured by Docker's logging system.
Is a custom log driver in use?
Check with:
Some drivers (like , , ) don’t work with .
Is this a Python app?
Python buffers stdout by default.
This command retrieves the standard output (stdout) and standard error (stderr) logs from the container.
The following example shows how to view Docker container logs.
How to View Logs of a Running Docker Container
To view the logs of a running Docker container, we can use the command followed by the container ID or name.
We can use the command to get the list of all Docker containers (both running and stopped).
The default driver, json-file, saves logs locally in JSON format, but you can choose other drivers to send logs to external systems for easier management and analysis.
How to Get/View Docker Logs
The command lets you view logs from a running container that uses the “json-file” or journald logging driver. Use external log drivers if you need log persistence.
Q: How do I save logs to a file?
A: Use shell redirection: or
Q: Why are my logs not showing up in real-time with -f?
A: Some applications buffer output.
The first command finds lines containing "ERROR", while the second uses case-insensitive matching () to find lines containing "failed", "error", or "exception". This helps correlate log events with external events or issues.
Starts displaying logs from a specific timestamp, then continues following new entries.
This setup helps keep your main application containers lightweight and easy to manage.
Wrapping Up
Docker logs are essential for monitoring container performance and resolving issues quickly.
Monitoring Docker containers is essential for keeping your applications stable and running smoothly. Understanding these drivers is crucial for production deployments:
Shows which log driver the container is using.
The log driver determines where logs are stored and whether they're accessible via the command.
Default json-file driver
Most containers use the driver, which stores logs as JSON files on the Docker host:
Runs a container with explicit log rotation settings. For example, to see logs for all containers in your Compose project, run the following command:
However, if you only want logs from one service, mention its name after the command.
Note: If you’re using an older version of Docker, the command might be (with a hyphen).
Docker only captures console output.
Solution: Configure applications to log to stdout/stderr, or use symbolic links:
Output buffering: Programming languages often buffer output, preventing immediate log visibility.
Solution: Disable buffering through environment variables:
Incorrect logging driver: Some drivers don't support command.
Solution: Check the logging driver and enable dual logging if needed:
Insufficient retention: Default settings may rotate logs too aggressively.
Solution: Adjust rotation parameters in :
No rotation: Some configurations lack proper rotation, leading to disk exhaustion.
Solution: Always configure appropriate log rotation and monitor disk usage.
Use when necessary or add your user to the docker group (consider security implications):
json-file (Default): Stores logs as JSON files.
You can use various formats like (30 minutes), (1 day), or (3 hours 30 minutes).
Pipes Docker logs through grep to filter for specific patterns.
Whether you're debugging a failing deployment, monitoring application performance, or investigating security incidents, understanding Docker's logging capabilities is fundamental to maintaining healthy containerized systems.
This guide walks you through Docker container logging from basic commands to production-ready strategies, including integration with observability platforms for comprehensive log analysis.
Understanding Docker's Logging Architecture
Docker captures all output from containerized applications that write to standard output (stdout) and standard error (stderr).
They include both standard output (stdout) and error messages (stderr), and allow you to find out how your container is performing and if there are any issues.
By default, Docker saves these logs as JSON files on the host system in the “/var/lib/docker/containers” directory. This helps you quickly identify error conditions without reading through all log output.
View Logs from All Your Containers
When working with multi-container applications, Docker Compose provides convenient log access across your entire application stack:
Displays logs from all services defined in your docker-compose.yml file, with each line prefixed by the service name.
You can run it as follows:
Replace with the actual name or ID of the container you want to check. Each container has its own log file named “[container_id]-json.log”. Docker logs let you see what’s happening inside your containers, and allows you to track performance, identify errors, and troubleshoot issues faster.
If you’re already sending metrics or traces through OpenTelemetry, you can route logs the same way and forward them to Last9, which supports native correlation across logs, metrics, and traces. The benefit?