Docker events monitoring - Commands & Configuration

Introduction

Sometimes you want to see what is happening inside Docker in real time. Docker events monitoring lets you watch actions like containers starting, stopping, or images being pulled. This helps you understand and troubleshoot Docker activity as it happens.

When you want to know immediately if a container crashes or stops.

When you are debugging why a container is restarting repeatedly.

When you want to audit what images are being pulled or removed on your system.

When you need to track network or volume changes related to Docker containers.

When you want to log Docker activity for security or compliance reasons.

Commands

This command shows Docker container start and stop events from the last 10 minutes. It helps you watch recent container activity live.

Terminal

docker events --filter event=start --filter event=stop --since 10m

Expected Output

2024-06-01T12:00:01.123456789Z container start 123abc456def (image=nginx:1.23, name=my-nginx)

2024-06-01T12:05:15.987654321Z container stop 123abc456def (image=nginx:1.23, name=my-nginx)

→

--filter - Filter events by type, like start or stop

→

--since - Show events only from a certain time ago

This command monitors only container 'die' events, which happen when a container stops unexpectedly. Useful for catching crashes.

Terminal

docker events --filter type=container --filter event=die

Expected Output

2024-06-01T12:10:30.123456789Z container die 789def123abc (image=redis:7.0, name=my-redis)

→

--filter - Filter events by container type and die event

This command shows image pull and remove events. It helps track when images are downloaded or deleted on your system.

Terminal

docker events --filter event=pull --filter event=remove

Expected Output

2024-06-01T12:15:00.000000000Z image pull sha256:abcdef1234567890

2024-06-01T12:20:00.000000000Z image remove nginx:1.23

→

--filter - Filter events by image pull and remove

Key Concept

If you remember nothing else from Docker events monitoring, remember: you can watch real-time Docker actions filtered by type to quickly understand what is happening.

Common Mistakes

Running 'docker events' without filters and expecting only container events.

Docker events include many types like network, volume, image, and container events, so output can be overwhelming.

Use --filter flags to narrow down events to only what you want to see.

Not using --since and watching events from the very start, causing too much output.

Without --since, the command streams all events from the daemon start, which can be very large and hard to follow.

Use --since with a recent time like '10m' or '1h' to limit output to recent events.

Summary

Use 'docker events' to watch Docker actions like container start, stop, image pull, and remove in real time.

Apply --filter flags to focus on specific event types and reduce noise.

Use --since to limit events to a recent time window for easier monitoring.