Docker events for real-time monitoring - Commands & Configuration

Introduction

Sometimes you want to see what is happening inside Docker right now. Docker events let you watch real-time actions like containers starting or stopping. This helps you understand and fix problems quickly.

When you want to know immediately if a container crashes or stops.

When you are debugging why a container is restarting repeatedly.

When you want to track image pulls or pushes as they happen.

When you need to audit Docker activity on a server in real time.

When you want to monitor network or volume changes live.

Commands

This command shows real-time events only for containers starting or stopping. Filters help focus on important actions.

Terminal

docker events --filter event=start --filter event=stop --filter type=container

Expected Output

2024-06-01T12:00:00.123456789Z container start 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:05:00.987654321Z container stop 123abc456def (image=nginx:1.23, name=my-nginx)

→

--filter event=start - Show only container start events

→

--filter event=stop - Show only container stop events

→

--filter type=container - Limit events to container type only

This command watches for containers that have stopped unexpectedly (died). Useful for catching crashes.

Terminal

docker events --filter event=die --filter type=container

Expected Output

2024-06-01T12:10:00.555555555Z container die 789def123abc (image=redis:7.0, name=my-redis)

→

--filter event=die - Show only container die events

→

--filter type=container - Limit events to container type only

This command shows image pull events in real time. It helps track when images are downloaded.

Terminal

docker events --filter event=pull --filter type=image

Expected Output

2024-06-01T12:15:00.111111111Z image pull nginx:1.23

→

--filter event=pull - Show only image pull events

→

--filter type=image - Limit events to image type only

This command shows all Docker events between two times. Useful for reviewing past activity.

Terminal

docker events --since 2024-06-01T12:00:00 --until 2024-06-01T12:20:00

Expected Output

2024-06-01T12:00:00.123456789Z container start 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:05:00.987654321Z container stop 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:10:00.555555555Z container die 789def123abc (image=redis:7.0, name=my-redis)

2024-06-01T12:15:00.111111111Z image pull nginx:1.23

→

--since - Start showing events from this time

→

--until - Stop showing events at this time

Key Concept

If you remember nothing else from this pattern, remember: docker events lets you watch live Docker actions to quickly spot what is happening.

Common Mistakes

Running docker events without filters and expecting only container events.

Docker events shows all event types by default, which can be overwhelming and hard to read.

Use --filter flags to narrow down events to the types you want to see.

Not stopping the docker events command and leaving it running forever.

docker events runs continuously and can fill your terminal or logs if not stopped.

Use Ctrl+C to stop the command when you have seen enough events.

Using incorrect date/time format with --since or --until flags.

Docker expects ISO 8601 format; wrong format causes errors or no output.

Use full ISO 8601 timestamps like 2024-06-01T12:00:00Z.

Summary

Use docker events to watch Docker actions in real time.

Apply filters to focus on specific event types like container start or stop.

Use --since and --until to view events in a specific time range.