Docker events for real-time monitoring - Commands & Configuration

Introduction

Sometimes you want to see what is happening inside Docker right now. Docker events let you watch real-time actions like containers starting or stopping. This helps you understand and fix problems quickly.

When you want to know immediately if a container crashes or stops.

When you are debugging why a container is restarting repeatedly.

When you want to track image pulls or pushes as they happen.

When you need to audit Docker activity on a server in real time.

When you want to monitor network or volume changes live.

Commands

This command shows real-time events only for containers starting or stopping. Filters help focus on important actions.

Terminal

docker events --filter event=start --filter event=stop --filter type=container

Expected Output

2024-06-01T12:00:00.123456789Z container start 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:05:00.987654321Z container stop 123abc456def (image=nginx:1.23, name=my-nginx)

→

--filter event=start - Show only container start events

→

--filter event=stop - Show only container stop events

→

--filter type=container - Limit events to container type only

This command watches for containers that have stopped unexpectedly (died). Useful for catching crashes.

Terminal

docker events --filter event=die --filter type=container

Expected Output

2024-06-01T12:10:00.555555555Z container die 789def123abc (image=redis:7.0, name=my-redis)

→

--filter event=die - Show only container die events

→

--filter type=container - Limit events to container type only

This command shows image pull events in real time. It helps track when images are downloaded.

Terminal

docker events --filter event=pull --filter type=image

Expected Output

2024-06-01T12:15:00.111111111Z image pull nginx:1.23

→

--filter event=pull - Show only image pull events

→

--filter type=image - Limit events to image type only

This command shows all Docker events between two times. Useful for reviewing past activity.

Terminal

docker events --since 2024-06-01T12:00:00 --until 2024-06-01T12:20:00

Expected Output

2024-06-01T12:00:00.123456789Z container start 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:05:00.987654321Z container stop 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:10:00.555555555Z container die 789def123abc (image=redis:7.0, name=my-redis)

2024-06-01T12:15:00.111111111Z image pull nginx:1.23

→

--since - Start showing events from this time

→

--until - Stop showing events at this time

Key Concept

If you remember nothing else from this pattern, remember: docker events lets you watch live Docker actions to quickly spot what is happening.

Common Mistakes

Running docker events without filters and expecting only container events.

Docker events shows all event types by default, which can be overwhelming and hard to read.

Use --filter flags to narrow down events to the types you want to see.

Not stopping the docker events command and leaving it running forever.

docker events runs continuously and can fill your terminal or logs if not stopped.

Use Ctrl+C to stop the command when you have seen enough events.

Using incorrect date/time format with --since or --until flags.

Docker expects ISO 8601 format; wrong format causes errors or no output.

Use full ISO 8601 timestamps like 2024-06-01T12:00:00Z.

Summary

Use docker events to watch Docker actions in real time.

Apply filters to focus on specific event types like container start or stop.

Use --since and --until to view events in a specific time range.

Practice

1. What is the primary purpose of the docker events command?

easy

A. To show real-time activity and changes in Docker objects

B. To list all Docker images available locally

C. To start a new Docker container

D. To remove unused Docker volumes

Solution

1. Step 1: Understand the command's function

   The docker events command streams live events related to Docker objects like containers, images, and networks.

2. Step 2: Compare with other Docker commands

   Commands like docker images, docker run, and docker volume prune serve different purposes unrelated to real-time event monitoring.

3. Final Answer:

   To show real-time activity and changes in Docker objects -> Option A

4. Quick Check:

   docker events = real-time Docker activity [OK]

Hint: Remember: events = live Docker activity stream [OK]

Common Mistakes:

• Confusing events with listing images
• Thinking it starts containers
• Assuming it cleans volumes

2. Which of the following is the correct syntax to show Docker events filtered by container ID abc123?

easy

A. docker events --filter container=abc123

B. docker events -c abc123

C. docker events --container abc123

D. docker events filter container abc123

Solution

1. Step 1: Recall Docker events filter syntax

   The correct filter syntax uses --filter key=value, so filtering by container ID is --filter container=abc123.

2. Step 2: Check other options for syntax errors

   Options B, C, and D use incorrect flags or missing dashes, making them invalid commands.

3. Final Answer:

   docker events --filter container=abc123 -> Option A

4. Quick Check:

   Filter syntax = --filter key=value [OK]

Hint: Use --filter key=value to filter events [OK]

Common Mistakes:

• Using short flags like -c which don't exist
• Omitting --filter or using wrong flag names
• Writing filter without dashes

3. What will be the output of the command docker events --filter event=start --filter container=mycontainer --since 10m?

medium

A. Shows all events for all containers in the last 10 minutes

B. Shows only start events for container 'mycontainer' from last 10 minutes

C. Shows stop events for container 'mycontainer' from last 10 minutes

D. Shows start events for all containers since 10 minutes ago

Solution

1. Step 1: Analyze the filters used

   The command filters events by event=start and container=mycontainer, so only start events for that container are shown.

2. Step 2: Understand the time filter

   The --since 10m option limits events to those in the last 10 minutes.

3. Final Answer:

   Shows only start events for container 'mycontainer' from last 10 minutes -> Option B

4. Quick Check:

   Filters combine to narrow events [OK]

Hint: Multiple --filter options combine to narrow events [OK]

Common Mistakes:

• Ignoring the container filter
• Confusing event=start with stop
• Misunderstanding --since time filter

4. You run docker events --filter event=stop --filter container=webapp but see no output even though the container stopped recently. What is the likely cause?

medium

A. The docker events command does not support filtering

B. The container never stopped

C. The container name is incorrect or misspelled

D. You need to add --since to see recent events

Solution

1. Step 1: Verify container name correctness

   If the container name is wrong or misspelled, no matching events will appear.

2. Step 2: Check command capabilities and event timing

   The docker events command supports filtering, and recent stop events should show without --since if they happened after the command started.

3. Final Answer:

   The container name is incorrect or misspelled -> Option C

4. Quick Check:

   Correct container name needed for filtering [OK]

Hint: Check container name spelling when no events appear [OK]

Common Mistakes:

• Assuming filtering is unsupported
• Forgetting container names are case-sensitive
• Thinking --since is always required

5. You want to monitor Docker events for container dbserver and automatically trigger a script when it stops. Which command correctly streams only stop events for that container?

hard

A. docker events --container=dbserver --event=stop

B. docker events --filter event=stop --container dbserver

C. docker events --filter stop --filter container=dbserver

D. docker events --filter container=dbserver --filter event=stop

Solution

1. Step 1: Use correct filter syntax for container and event

   The correct syntax uses --filter key=value. So --filter container=dbserver and --filter event=stop are valid.

2. Step 2: Identify invalid options

   Options B, C, and D use incorrect flags like --container or missing event= format, which are invalid.

3. Final Answer:

   docker events --filter container=dbserver --filter event=stop -> Option D

4. Quick Check:

   Use --filter key=value for all filters [OK]

Hint: Always use --filter key=value for event and container filters [OK]

Common Mistakes:

• Using --container or --event flags incorrectly
• Omitting 'event=' or 'container=' in filters
• Mixing filter syntax with invalid flags