Ever needed to get hold of what is going on in Docker or why some logs seem to be outside of the usual log files. Heck even Docker logs does not give you the information you are looking for and yet your containers seem to restart without you having any trace of that.

Docker logs

Docker comes with a very convenient command logs which displays the container’s logs and allow you to see what is being executed inside a given container.
This command can be used like this:

docker logs <container_id || container_name>

This does the trick like 80% of the time. But what if for example my docker container is configured to restart automatically (through a docker compose for instance) and the uptime I see for the container is not aligned with a manual restart (i.e the container was restarted but you don’t know why).

Docker events

For the case described above, Docker has some specific tools which give information about internal Docker events. Among these events we can find start, stop, restart and lot more.

Important note: the docker event command behaves like a listener when executed without timestamp options (–since and –until). This means that you will get no output when you execute the command until the first event happens.

We will not detail all of the docker events; we merely list the main once. Please have a look at the docker documentation and man pages for more information.

Docker container events

Docker container report the following events which can be displayed:

• attach, commit, copy, create, destroy, detach, die, exec_create, exec_detach, exec_start, export, kill, oom, pause, rename, resize, restart, start, stop, top, unpause, update

Docker images events

Docker images report the following events which can be displayed:

• delete, import, load, pull, push, save, tag, untag

Docker volumes events

Docker volumes report the following events which can be displayed:

• create, mount, unmount, destroy

Docker networks events

Docker networks report the following events which can be displayed:

• create, connect, disconnect, destroy

Docker daemon events

The docker daemon reports the following event which can be displayed: reload

Usage

The docker event options

Docker has 3 options to display events:

• filter: allows to filter the event type
• since/until: allows to filter events according to a timestamps. These two options can be used separately or combined
• format: used to format the output

Examples

Here some examples of the docker event command with different options

# display all docker events that occured between October 30th and today
docker events --since '2024-10-30'

# display all docker events related to an out of memory exception
docker events --filter 'event=oom'

# display qll docker events related to containers and format the output to have the type, the status and the id
docker events --filter 'type=container' --format 'Type={{.Type}}  Status={{.Status}}  ID={{.ID}}'

# display docker events and format the output as json
docker events --format '{{json .}}'

# diaplay all events for the conrtainer with id 9832d2e44176 that are related to a container restart and that occured between the 30th and the 31st of October
docker events --filter 'container=9832d2e44176' --filter 'event=restart' --since '2024-10-30' --until '2024-10-31'