Docker events monitoring - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Understanding Docker events output

What is the output of the command docker events --filter 'event=start' --since 1m --until 0m if a container named webapp started exactly 30 seconds ago?

Docker

docker events --filter 'event=start' --since 1m --until 0m

A No output because the container started before 1 minute ago

B 2024-06-01T12:00:30.000000000Z container start webapp (container_id)

C 2024-06-01T12:00:30.000000000Z container stop webapp (container_id)

D Error: invalid filter syntax

💡 Hint

The command filters events for container start within the last minute.

The command shows events filtered by 'start' event type between 1 minute ago and now. Since the container started 30 seconds ago, its start event appears.

🧠 Conceptual

intermediate

Purpose of Docker events monitoring

Which of the following best describes the main purpose of using docker events in a DevOps workflow?

A To build Docker images from a Dockerfile

B To remove unused Docker volumes and networks

C To list all running containers with their resource usage

D To monitor real-time changes and lifecycle events of Docker objects like containers and images

💡 Hint

Think about what events represent in Docker.

Docker events provide a live stream of changes such as container start, stop, create, and destroy, which helps track Docker object states.

❓ Troubleshoot

advanced

Troubleshooting missing Docker events

You run docker events --filter 'container=webapp' but see no events even though the container is actively restarting. What is the most likely reason?

A The container name filter is case-sensitive and the actual container name is 'WebApp'

B Docker daemon is not running, so no events are generated

C The <code>docker events</code> command only shows image events, not container events

D The container is restarting too fast and events are missed by the command

💡 Hint

Check the exact container name spelling and case.

Docker filters are case-sensitive. If the container name filter does not exactly match, no events appear.

🔀 Workflow

advanced

Automating alert on container stop event

Which command pipeline correctly monitors Docker events and sends an alert message when any container stops?

A docker events --filter 'event=stop' | while read line; do echo "Alert: Container stopped - $line"; done

B docker ps --filter 'status=stopped' | echo "Alert: Container stopped"

C docker logs --follow | grep 'stopped' | echo "Alert: Container stopped"

D docker events --filter 'event=stop' --quiet

💡 Hint

Think about streaming events and reacting to each line.

Option A streams stop events and processes each line to print an alert message. Others either do not stream events or do not produce alerts.

✅ Best Practice

expert

Efficient Docker events monitoring in production

What is the best practice to efficiently monitor Docker events in a production environment without losing events during high load?

A Poll 'docker ps' every second to detect container state changes instead of using events

B Run 'docker events' with no filters and parse output manually in a shell script

C Use a dedicated logging driver like 'json-file' or 'syslog' combined with a centralized log collector instead of relying solely on 'docker events' CLI

D Restart the Docker daemon frequently to clear event buffers and avoid overload

💡 Hint

Consider reliability and scalability of event monitoring.

Using logging drivers with centralized log collection ensures no events are lost and supports high load better than CLI streaming alone.

Practice

1. What does the docker events command do?

easy

A. Displays the Docker container logs

B. Lists all Docker images on the system

C. Shows real-time Docker activity and events

D. Removes unused Docker volumes

Solution

1. Step 1: Understand the purpose of docker events

   This command streams real-time events from the Docker daemon, showing activities like container start, stop, create, etc.

2. Step 2: Compare with other Docker commands

   Other options like listing images, showing logs, or removing volumes do not relate to event monitoring.

3. Final Answer:

   Shows real-time Docker activity and events -> Option C

4. Quick Check:

   docker events = real-time Docker activity [OK]

Hint: Remember: events = live Docker activity stream [OK]

Common Mistakes:

• Confusing events with logs
• Thinking it lists images
• Assuming it cleans resources

2. Which of the following is the correct syntax to monitor Docker events for a specific container with ID abc123?

easy

A. docker logs --events abc123

B. docker events --filter container=abc123

C. docker monitor --container abc123

D. docker events -c abc123

Solution

1. Step 1: Identify the correct filter syntax for docker events

   The correct filter flag is --filter or -f with key=value pairs, e.g., container=abc123.

2. Step 2: Check other options for correctness

   Options A, B, and C use invalid commands or flags not supported by docker events.

3. Final Answer:

   docker events --filter container=abc123 -> Option B

4. Quick Check:

   Use --filter container=ID to monitor specific container events [OK]

Hint: Use --filter container=ID to target container events [OK]

Common Mistakes:

• Using wrong flags like -c
• Confusing docker logs with docker events
• Using non-existent commands like docker monitor

3. What will be the output of the command docker events --filter event=start --filter container=myapp when the container myapp starts?

medium

A. A real-time event line showing the container myapp started

B. A list of all containers currently running

C. An error saying invalid filter syntax

D. No output until the container stops

Solution

1. Step 1: Understand the filters used

   The command filters events to show only start events for the container named myapp.

2. Step 2: Predict output when container starts

   When myapp starts, the command outputs a line describing this event in real-time.

3. Final Answer:

   A real-time event line showing the container myapp started -> Option A

4. Quick Check:

   Filtered events show matching container start events [OK]

Hint: Filters show only matching events live [OK]

Common Mistakes:

• Expecting a list of containers instead of events
• Thinking filters cause errors
• Assuming output only on container stop

4. You run docker events --filter event=stop --filter container=webapp but see no output when the container webapp stops. What is the most likely cause?

medium

A. The docker daemon is not running

B. Docker events do not capture stop events

C. The command syntax is invalid

D. The container name is incorrect or misspelled

Solution

1. Step 1: Verify container name correctness

   If the container name is wrong, no matching events will appear even if the container stops.

2. Step 2: Check other possibilities

   The docker daemon must be running for events; syntax is correct; stop events are captured by docker events.

3. Final Answer:

   The container name is incorrect or misspelled -> Option D

4. Quick Check:

   Correct container name needed for event filtering [OK]

Hint: Check container name spelling when no events appear [OK]

Common Mistakes:

• Assuming docker events miss stop events
• Ignoring daemon status
• Thinking syntax is wrong without checking name

5. You want to monitor Docker events for containers with label env=production and only see start and die events. Which command achieves this?

hard

A. docker events --filter label=env=production --filter event=start --filter event=die

B. docker events --filter label=env=production --filter event=start,die

C. docker events --filter label=env=production --filter event=start --filter event=stop

D. docker events --filter env=production --filter event=start --filter event=die

Solution

1. Step 1: Use multiple --filter flags for each event

   Docker events supports multiple filters; to filter multiple events, repeat the --filter event= flag for each event.

2. Step 2: Use correct label filter syntax

   The label filter requires label=key=value format, so label=env=production is correct.

3. Step 3: Eliminate incorrect options

   docker events --filter label=env=production --filter event=start,die uses comma-separated events which is invalid; docker events --filter label=env=production --filter event=start --filter event=stop uses stop instead of die; docker events --filter env=production --filter event=start --filter event=die uses incorrect label filter syntax.

4. Final Answer:

   docker events --filter label=env=production --filter event=start --filter event=die -> Option A

5. Quick Check:

   Multiple --filter flags for each event and correct label syntax [OK]

Hint: Repeat --filter for each event; label filter needs key=value [OK]

Common Mistakes:

• Using comma-separated events in one filter
• Wrong label filter syntax
• Confusing event names like die vs stop