Detailed explanation of where Docker saves log files

Debugging most Linux programs usually involves examining log files, which can be a complex process. However, when running in a containerized environment under Docker, you need to use more specific tools to debug your application in production.

Where are the logs stored?

The simple answer is that Docker stores container logs in its primary storage location, /var/lib/docker/. Each container has a log specific to its ID (the full ID, not the shortened one that's usually shown), and you can access it like this:

/var/lib/docker/containers/ID/ID-json.log

That's where they are stored, but since they are in JSON format they are not easy to read, and having to use the full container ID is annoying. Docker provides a built-in command to view them:

docker logs -f e4bd48ef3103

Here, the -f flag will keep the prompt open and "watch" for any new entries in the file. You can also use --tail to tail the file, or use --timestamps to show log times, or use --until and --since to filter based on time.

If you use Docker Compose, you can easily view all logs using the log command within it:

docker-compose logs

One thing you'll notice, however, is that STDOUT and STDERR, which are useful for a lot of things, only show console output for the entry point specified by "CMD" in the Docker file. Many applications have their own dedicated logging systems, which typically log to /var/log/nginx/access.log. Such logs can still be accessed from the host side via Docker.

View logs from an application inside a container

Depending on the container, this may not be necessary. For example, the default NGINX container is set up to send its Docker logs to STDOUT to simplify log inspection. It does this using a /dev/stdout symlink to the log file, you could set up something similar for your container.

RUN ln -sf /dev/stdout /var/log/nginx/access.log 
&& ln -sf /dev/stderr /var/log/nginx/error.log

However, if you want to view a specific file inside the container, you can do so. Docker provides the exec -it command which allows you to run any command within any running Docker process. Using it, you can tail log files inside a Docker container:

docker exec -it e4bd48ef3103 tail -f log.txt

Because this allows you to run any command, you can use journalctl or any other debugging strategy you want, as long as you start it as docker exec -it ./bin/bash . You can even run if you want to jump in and poke around.

A more permanent solution that is more suitable for hosting services is to use Docker volume mounts. You can bind-mount a directory like /var/log/nginx to a volume visible to the host. First, create a new volume:

docker volume create nginx-logs

And run the container --mount with the following command:

docker run -d \
--name devtest \
--mount source=nginx-logs,target=/var/log/nginx \
nginx:latest

If you use Docker Compose, the process can be automated:

version: "3.0"
services:
  web:
    image: nginx:latest
    ports:
      - "80:80"
    volumes:
      - nginx-logs:/var/log/nginx/
volumes:
  nginx-logs:

This way, any log aggregation service on the host can ingest the log files directly.

View Docker daemon logs

If you want to view specific logs for the entire Docker service on your server, rather than any particular containerized application, you need to view the journalctl logs:

sudo journalctl -fu docker.service

This is where it is stored on most systems, but it is located differently on some systems:

• Amazon Linux: /var/log/docker
• CentOS/RHEL: /var/log/messages | grep docker
• Apple: ~/Library/Containers/com.docker.docker/Data/log/vm/dockerd.log
• Windows: AppData\Roaming\Docker\log\vm\dockerd.log

This is the end of this article about where Docker saves log files. For more information about Docker saving log files, please search for previous articles on 123WORDPRESS.COM or continue to browse the following related articles. I hope everyone will support 123WORDPRESS.COM in the future!