DockerHow-ToBeginner · 3 min read

How to Use Docker Events: Monitor Docker Activity Easily

Use the docker events command to listen to real-time events from the Docker daemon, such as container start, stop, or image pull. Run docker events in your terminal to see a live stream of Docker activity with event details.

📐

Syntax

The docker events command streams real-time events from the Docker daemon. You can filter events by type, container, image, or time range.

Key parts:

docker events: Starts the event stream.
--filter: Filters events by criteria like event=stop or container=container_id.
--since and --until: Show events from a specific time range.

bash

docker events [OPTIONS]

Options:
  --filter filter    Filter output based on conditions provided
  --since string     Show events since timestamp
  --until string     Show events until timestamp

💻

Example

This example shows how to run docker events to watch all Docker events live. Then, it filters events to show only container start and stop events.

bash

# Run to see all events live
sudo docker events

# Run to filter only container start and stop events
sudo docker events --filter 'event=start' --filter 'event=stop'

Output

2024-06-01T12:00:00.123456789Z container start 123abc456def (image=nginx:latest, name=webserver) 2024-06-01T12:05:00.987654321Z container stop 123abc456def (image=nginx:latest, name=webserver)

⚠️

Common Pitfalls

Common mistakes when using docker events include:

Not running the command with sufficient permissions (use sudo if needed).
Expecting past events without specifying --since (by default, it shows live events only).
Using incorrect filter syntax, which results in no output.

Always check your filters and permissions.

bash

# Wrong: No sudo, may fail on some systems

docker events

# Right: Use sudo for permissions

sudo docker events

# Wrong: Incorrect filter syntax

sudo docker events --filter event=start

# Right: Correct filter syntax with quotes

sudo docker events --filter 'event=start'

📊

Quick Reference

Option	Description	Example
--filter	Filter events by type, container, image, etc.	--filter 'event=stop'
--since	Show events since a timestamp or relative time	--since 1h
--until	Show events until a timestamp	--until 2024-06-01T12:00:00
No options	Show live stream of all Docker events	docker events

✅

Key Takeaways

Use docker events to monitor Docker daemon activity in real time.

Apply --filter to narrow down events by type or container.

Run with proper permissions, often requiring sudo.

By default, docker events shows live events only, use --since for past events.

Check filter syntax carefully to avoid missing events.