When running applications in a Container, many times you need to debug application issues by checking the logs in a containerized application. Docker has a robust logging feature that allows a user to view, save and manage logs in a container application.

In this post, we shall look at how you can capture logs as they stream from your containerized application. This enables you to monitor application better and ensure smooth operation of the services.

Docker Logging Drivers

The default log driver is json-file which uses file-based storage and Docker daemon has access to these files. You can check the default logging driver by running:

$ sudo docker info|grep ' Logging Driver'
 Logging Driver: json-file

The setting of log driver can set in a file /etc/docker/daemon.json . See example below.

$ sudo vim /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

Other log drivers supported by Docker are:

• Local file logging driver
• Syslog logging driver
• Journald logging driver
• Graylog Extended Format logging driver
• Amazon CloudWatch Logs logging driver
• Fluentd logging driver
• Google Cloud Logging driver
• Splunk logging driver

To get a list of all Docker Supported Logs, run:

$ sudo docker info|grep Log:
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog

To configure another logging driver, refer to the official documentation using the provided links.

Tail Live Logs in Docker Container (Without Compose)

When running Docker CLI commands without the use of Compose. First identify the container you want to see live logs.

$ sudo docker ps
CONTAINER ID   IMAGE                      COMMAND                  CREATED      STATUS                   PORTS                                       NAMES
08ebee44c00f   redis:alpine               "docker-entrypoint.s…"   2 days ago   Up 6 minutes             6379/tcp                                    chatwoot-redis-1
ad56f11e6f54   postgres:12                "docker-entrypoint.s…"   2 days ago   Up 6 minutes             5432/tcp                                    chatwoot-postgres-1

To get a list of all containers including failed ones use:

sudo docker ps -a

To tail container logs in real-time, use the docker logs command with the -f (follow) command option.

docker logs -f <container_name_or_ID>

For example, for the container ID is 08ebee44c00f or chatwoot-redis-1, we would run:

$ docker logs -f chatwoot-redis-1
....
1:M 03 Jul 2024 11:47:40.118 * Background saving terminated with success
1:M 03 Jul 2024 11:52:41.055 * 100 changes in 300 seconds. Saving...
1:M 03 Jul 2024 11:52:41.055 * Background saving started by pid 35
35:C 03 Jul 2024 11:52:41.067 * DB saved on disk
35:C 03 Jul 2024 11:52:41.067 * Fork CoW for RDB: current 0 MB, peak 0 MB, average 0 MB
1:M 03 Jul 2024 11:52:41.156 * Background saving terminated with success
1:M 03 Jul 2024 11:57:42.034 * 100 changes in 300 seconds. Saving...
1:M 03 Jul 2024 11:57:42.035 * Background saving started by pid 36
36:C 03 Jul 2024 11:57:42.045 * DB saved on disk
36:C 03 Jul 2024 11:57:42.045 * Fork CoW for RDB: current 0 MB, peak 0 MB, average 0 MB
1:M 03 Jul 2024 11:57:42.135 * Background saving terminated with success
1:M 03 Jul 2024 12:02:43.070 * 100 changes in 300 seconds. Saving...
1:M 03 Jul 2024 12:02:43.070 * Background saving started by pid 37
37:C 03 Jul 2024 12:02:43.080 * DB saved on disk
37:C 03 Jul 2024 12:02:43.080 * Fork CoW for RDB: current 0 MB, peak 0 MB, average 0 MB
1:M 03 Jul 2024 12:02:43.171 * Background saving terminated with success
1:M 03 Jul 2024 12:07:44.075 * 100 changes in 300 seconds. Saving...
1:M 03 Jul 2024 12:07:44.076 * Background saving started by pid 38
38:C 03 Jul 2024 12:07:44.082 * DB saved on disk
38:C 03 Jul 2024 12:07:44.083 * Fork CoW for RDB: current 0 MB, peak 0 MB, average 0 MB
1:M 03 Jul 2024 12:07:44.176 * Background saving terminated with success

Tailing the Last N Lines

If we want to only tail the last N lines of the logs, we use –tail option:

docker logs --tail 100 -f 08ebee44c00f

Including timestamp

To include the timestamps in your log output, pass the -t option:

docker logs -f -t 08ebee44c00f

With --tail

docker logs --tail 100 -f -t 08ebee44c00f

Include --until or --since option to display logs up to a specific date or time. This can be relative time or timestamp. See below examples:

docker logs --follow --until=10s <CONTAINER>
docker logs --follow --until=20m <CONTAINER>

docker logs --follow --until=10s <CONTAINER>
docker logs --follow --until=20m <CONTAINER>

docker logs --since 2023-12-02 <container_name_or_ID> #Display logs from June 2, 2023, onwards.

Tail Live Logs in Docker Compose

When using Docker Compose, you can also tail live logs in your containerized services. For this, we use docker-compose logs command but with the -f (follow) option.

Tail logs for all services

If you want to tail logs for all services defined in Docker Compose file, run:

docker compose logs -f --tail 100

The command should be run from a directory with the docker-compose.yml file.

To include timestamps, run:

docker compose logs -t -f --tail 100

Tail logs for a specific service

You can follow logs for single service defined in your docker-compose.yml file under services: section:

docker-compose logs -f <service_name>

If the service is named redis, we would run:

docker-compose logs -f redis

To show only the last 100 lines, we run:

docker-compose logs --tail 100 -f redis

Use -t or --timestamps to include timestamps in each log entry.

docker-compose logs -t --tail 50 -f redis

Conclusion

In this blog post we have demonstrated how to efficiently tail live logs from your containerized applications using docker logs and the docker-compose logs command. We believe this allows you to troubleshoot your containerized applications and monitor them in real-time for quicker response time to issues.