Docker logs for troubleshooting - Step-by-Step Execution

Process Flow - Docker logs for troubleshooting

Start Container

↓

Container Runs

↓

Logs Generated

↓

Run 'docker logs <container>'

↓

View Logs Output

↓

Analyze Logs for Errors

↓

Fix Issues or Restart Container

This flow shows how Docker containers generate logs, how to fetch them using the docker logs command, and then analyze those logs to troubleshoot issues.

Execution Sample

Docker

docker run -d --name myapp nginx
sleep 2
docker logs myapp

Starts an nginx container named 'myapp', waits 2 seconds, then fetches and shows its logs.

Process Table

Step	Command	Action	Output/Result
1	docker run -d --name myapp nginx	Start nginx container in background	Container ID printed, container running
2	sleep 2	Wait 2 seconds for container to initialize	No output, pause
3	docker logs myapp	Fetch logs from 'myapp' container	Shows nginx startup logs, e.g. 'nginx started'
4	docker logs myapp --tail 5	Fetch last 5 log lines	Shows last 5 lines of logs
5	docker logs myapp --follow	Stream logs live	Shows logs continuously until stopped
6	docker logs unknown	Try logs on non-existent container	Error: No such container: unknown

💡 Logs fetched or error shown if container does not exist

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
container_status	none	running	running	running	running
logs_output	empty	empty	empty	nginx startup logs	nginx startup logs or error

Key Moments - 3 Insights

Why do we use 'docker logs' after starting a container?

Because the container runs in the background, 'docker logs' lets us see what happened inside it, like startup messages or errors, as shown in step 3 of the execution_table.

What happens if we try to get logs from a container that doesn't exist?

Docker shows an error message 'No such container', as seen in step 6 of the execution_table, indicating the container name is wrong or container is not running.

How can we see logs as they happen in real time?

Using 'docker logs --follow' streams the logs live, shown in step 5, so we can watch new log lines appear continuously.

Visual Quiz - 3 Questions

Look at the execution_table, what is the output of 'docker logs myapp' at step 3?

A Error: No such container

B Shows nginx startup logs

C Container ID printed

D No output

💡 Hint

Check the 'Output/Result' column for step 3 in execution_table

At which step does Docker show an error for a non-existent container?

A Step 6

B Step 4

C Step 2

D Step 1

💡 Hint

Look for 'Error' message in the 'Output/Result' column in execution_table

If we want to see only the last 5 lines of logs, which command should we use?

A docker logs myapp

B docker logs myapp --follow

C docker logs myapp --tail 5

D docker run myapp

💡 Hint

Refer to step 4 in execution_table for the command that fetches last 5 lines

Concept Snapshot

Docker logs let you see what happens inside a container.
Use 'docker logs <container>' to fetch logs.
Add '--tail N' to see last N lines.
Add '--follow' to stream logs live.
Errors appear if container name is wrong.
Logs help find and fix container issues.

Full Transcript

This lesson shows how Docker containers produce logs and how to use the 'docker logs' command to view them. First, you start a container in the background. Then, you run 'docker logs <container>' to see what happened inside, like startup messages. You can limit output with '--tail' or watch logs live with '--follow'. If you ask for logs of a container that doesn't exist, Docker shows an error. These logs are useful to troubleshoot and fix problems inside containers.

Practice

1. What is the primary purpose of the docker logs command?

easy

A. To start a new Docker container

B. To remove a Docker container

C. To list all Docker images on the system

D. To view the output and error messages of a running or stopped container

Solution

1. Step 1: Understand the role of docker logs

   This command is designed to show the logs generated by a container, including output and error messages.

2. Step 2: Compare with other Docker commands

   Starting containers uses docker run, listing images uses docker images, and removing containers uses docker rm.

3. Final Answer:

   To view the output and error messages of a running or stopped container -> Option D

4. Quick Check:

   docker logs = view container output [OK]

Hint: Logs show container output and errors, not start or remove [OK]

Common Mistakes:

• Confusing logs with starting or removing containers
• Thinking logs list images
• Assuming logs modify container state

2. Which of the following is the correct syntax to show the last 10 lines of logs from a container named webapp?

easy

A. docker logs --tail 10 webapp

B. docker logs -n 10 webapp

C. docker logs --last 10 webapp

D. docker logs -lines 10 webapp

Solution

1. Step 1: Recall the correct option for tailing logs

   The --tail option followed by a number shows that many lines from the end of the logs.

2. Step 2: Verify other options

   -n, --last, and -lines are not valid options for docker logs.

3. Final Answer:

   docker logs --tail 10 webapp -> Option A

4. Quick Check:

   Use --tail to limit log lines [OK]

Hint: Use --tail to show last lines of logs [OK]

Common Mistakes:

• Using -n or --last which are invalid
• Confusing tail with head
• Forgetting container name at the end

3. Given the command docker logs --since 2024-06-01T12:00:00 webapp, what will be the output?

medium

A. Logs from the container webapp before June 1, 2024, 12:00 PM

B. Logs from the container webapp starting from June 1, 2024, 12:00 PM

C. All logs from the container webapp without any time filter

D. An error because the date format is incorrect

Solution

1. Step 1: Understand the --since option

   This option filters logs to show only those generated after the specified date and time.

2. Step 2: Check the date format

   The ISO 8601 format YYYY-MM-DDTHH:MM:SS is valid for this option, so no error occurs.

3. Final Answer:

   Logs from the container webapp starting from June 1, 2024, 12:00 PM -> Option B

4. Quick Check:

   --since filters logs after given time [OK]

Hint: Use --since with ISO 8601 date to filter logs [OK]

Common Mistakes:

• Thinking --since shows logs before the date
• Assuming date format is invalid
• Expecting all logs without filter

4. You run docker logs -f mycontainer but see no new logs even though the app is running. What is a likely cause?

medium

A. The container mycontainer is not producing any new output

B. The -f option is invalid and causes no output

C. You forgot to specify the container ID instead of the name

D. The Docker daemon is stopped

Solution

1. Step 1: Understand the -f option

   The -f or --follow option streams new logs as they appear.

2. Step 2: Analyze why no new logs appear

   If the app inside the container does not produce new output, the log stream stays empty despite the container running.

3. Final Answer:

   The container mycontainer is not producing any new output -> Option A

4. Quick Check:

   -f streams logs; no output means no new logs [OK]

Hint: No new logs means app inside container is silent [OK]

Common Mistakes:

• Thinking -f is invalid syntax
• Confusing container name and ID
• Assuming Docker daemon is stopped without checking

5. You want to troubleshoot a container named dbserver that crashed. You need to see the last 50 lines of logs and follow new logs as they appear. Which command should you use?

hard

A. docker logs -n 50 -f dbserver

B. docker logs -f --since 50 dbserver

C. docker logs --tail 50 -f dbserver

D. docker logs --follow --last 50 dbserver

Solution

1. Step 1: Identify correct options for tail and follow

   --tail 50 shows last 50 lines, and -f streams new logs.

2. Step 2: Check option validity

   --since 50 is invalid because --since expects a timestamp, not a number. --last and -n are not valid options for docker logs.

3. Final Answer:

   docker logs --tail 50 -f dbserver -> Option C

4. Quick Check:

   Use --tail and -f together for last lines and live logs [OK]

Hint: Combine --tail and -f to see recent and live logs [OK]

Common Mistakes:

• Using --since with a number instead of timestamp
• Using invalid options like --last or -n
• Mixing option order incorrectly