Here’s a complete tutorial on docker logs, explaining what it does, a comprehensive list of examples, and use cases.

---

What is docker logs?

docker logs is a Docker command used to retrieve logs from a running or stopped container. It shows the stdout (standard output) and stderr (standard error) streams of the main process inside the container.

Key Features:

• Works for both running and stopped containers.
• Supports real-time log streaming (--follow).
• You can filter logs by time or show recent logs (--since, --tail).
• Helps in debugging and monitoring containerized services.

---

Basic Syntax

docker logs [OPTIONS] CONTAINER

Common Options:

• -f, --follow: Stream real-time logs.
• --since: Show logs since a specific timestamp (--since 10m for last 10 minutes).
• --tail: Show only the last n lines (--tail 50).
• -t, --timestamps: Show timestamps for each log line.
• --details: Show additional information provided by the container (if available).

---

Examples of docker logs

1. Show Logs from a Running Container

docker logs my_container

This displays all logs from my_container.

---

2. Follow Logs in Real-Time

docker logs -f my_container

This streams the logs in real-time. New log entries appear as they are written.

---

3. Show Logs with Timestamps

docker logs -t my_container

This displays logs with timestamps, useful for tracking when each event occurred.

---

4. Show the Last 50 Lines of Logs

docker logs --tail 50 my_container

This shows only the most recent 50 lines of logs.

---

5. Show Logs Since a Specific Time

docker logs --since "2023-02-07T12:00:00" my_container

This displays logs generated after 12:00 PM on February 7, 2023.

---

6. Show Logs from the Last 10 Minutes

docker logs --since 10m my_container

This shows logs generated in the last 10 minutes.

---

7. Combine Options: Follow Logs with a Time Filter

docker logs -f --since 5m my_container

This streams real-time logs and includes logs from the last 5 minutes.

---

8. View Logs from a Stopped Container

docker logs my_stopped_container

You can still retrieve logs from a container even after it has stopped.

---

9. Use docker logs in a Script

#!/bin/bash
docker logs --tail 100 my_app > logs.txt
echo "Logs saved to logs.txt"

This script saves the last 100 lines of logs from my_app to logs.txt.

---

10. Filter Logs from a Specific Service in Docker Compose

docker-compose logs my_service

This displays logs for a specific service (my_service) in a Docker Compose setup.

---

Use Cases for docker logs

1. Debugging Application Issues

• View logs to identify errors or crashes.
• Example: Check logs for a web server (nginx) to find why it’s returning 500 errors.

2. Monitoring Real-Time Activity

• Stream logs in real-time to monitor container activity.
• Example: Watch real-time logs from a Node.js application to see incoming requests.

3. Tracking Application Performance

• Use timestamps to analyze performance over time.
• Example: Measure how long certain tasks take in a background worker container.

4. Security and Auditing

• Review logs for security incidents or unauthorized access attempts.
• Example: Check logs from a MySQL container for failed login attempts.

5. Log Analysis for Business Insights

• Extract and analyze logs to gain insights into user behavior or system performance.
• Example: Analyze web server logs to track page visits.

6. CI/CD Pipelines and Testing

• Use logs to debug failed tests or builds in CI/CD pipelines.
• Example: Check logs from a test runner container to identify why tests failed.

---

List of Common docker logs Commands

Command	Description
docker logs my_container	Show all logs from the container
docker logs -f my_container	Stream logs in real-time
docker logs -t my_container	Show logs with timestamps
docker logs --tail 100 my_container	Show the last 100 lines of logs
docker logs --since "2023-02-07T12:00:00" my_container	Show logs since a specific time
docker logs --since 10m my_container	Show logs from the last 10 minutes
docker logs -f --since 5m my_container	Stream logs in real-time from the last 5 minutes
docker logs my_stopped_container	View logs from a stopped container

---

Best Practices for Using docker logs:

1. Use --tail to avoid overwhelming output, especially for large logs.
2. Stream logs in real-time (-f) when monitoring services.
3. Combine with --since and --timestamps for accurate debugging.
4. Centralize logs using tools like ELK (Elasticsearch, Logstash, Kibana) or Promtail/Loki/Grafana for better management and searchability.
5. Rotate logs regularly to avoid disk space issues (log-opts can help).

---

Common Errors and Solutions

1. “No such container”
   → Ensure the container exists and is running/stopped. Use docker ps -a to verify.
2. “Container is not writing logs”
   → Check the container’s logging driver (docker inspect) to ensure it’s set to json-file or another supported driver.
3. Logs are too large
   → Use --tail or --since to filter logs and reduce output size. Consider enabling log rotation.

---

Combining docker logs with Other Commands

Check Logs and Restart a Container

docker logs my_app
docker restart my_app

Monitor Logs and Check Resource Usage

docker logs -f my_app &
docker stats my_app

---