iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with docker logs CONTAINER. It shows what the container’s main process wrote to standard output and standard error, which is usually the fastest way to see why an application failed. Add --follow to watch new messages as they arrive or --tail 100 to limit the initial output.
If the command is empty or does not explain the failure, check three boundaries in order: whether the application writes to stdout and stderr, which Docker logging driver the container uses, and whether Docker itself recorded a lifecycle event or daemon error.
Start with the container’s stdout and stderr
Use the container name or ID:
docker logs CONTAINERDocker documents this command as showing information logged by a running container. The information and format depend almost entirely on the container’s endpoint command, so the result is the process’s standard output and standard error—not an automatic scan of every log file inside the container.
Show only recent messages
docker logs --tail 100 CONTAINERThe value 100 is a practical sample size, not a Docker default. Increase or decrease it when the relevant message is farther from or nearer to the end of a long stream. Starting with a bounded tail is useful on a busy service because it gets you to the latest startup, request, or shutdown messages without waiting for a large history to print.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Follow output while reproducing the problem
docker logs --follow CONTAINERLeave this command running, then reproduce the request, startup, or health-check failure in another terminal. Press Ctrl+C to stop following; this does not stop the container. Following is especially valuable for restart loops: the useful message may appear only for a few seconds between a start event and the next exit.
View logs for a Swarm service
docker service logs SERVICEUse the service-level command when the workload is a Docker service and you need output from the containers participating in that service rather than one standalone container. A service can have multiple tasks, so service logs are appropriate when a failure may be isolated to one replica or move between replicas.
Read output without changing the container
Viewing logs is non-destructive. The command does not restart, pause, or stop the container. That makes it safe to run while an incident is in progress, although reading output does not prevent the configured driver or backend from reaching its own storage limits.
Recommended Free Tools
Identify the correct container before diagnosing it
Include stopped containers
A container that exited will not appear in the running-only list. List all containers first:
docker ps -aCopy the exact name or ID from the result, then request its output:
docker logs --tail 100 CONTAINERUsing the wrong similarly named container is a common reason for apparently irrelevant logs. Confirm the image, name, and creation time shown by docker ps -a before drawing conclusions. A stopped container can still have useful output retained by its logging configuration, so do not remove it until you have captured the evidence you need.
Capture output at the moment of failure
For a container that repeatedly starts and exits, run docker logs --follow CONTAINER as soon as it starts, or retrieve the latest lines immediately after it stops. A short-lived process may emit its only useful diagnostic message during startup. Compare more than one attempt when possible: identical output suggests a deterministic startup problem, while different output can indicate a dependency, timing, or resource condition.
Understand what Docker logs can and cannot show
Docker reads the process output streams
docker logs reflects bytes written by the container’s endpoint process to file descriptor 1 (stdout) and file descriptor 2 (stderr). It does not inherently read application files such as /var/log/app.log inside the container. A shell, supervisor, or wrapper used as the endpoint can also affect what reaches those streams.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
File-based application logging can make the command look empty
An application can be healthy and writing detailed records to a file while emitting nothing to stdout or stderr. In that case, an empty Docker stream does not prove that the application produced no diagnostics. Inspect the application’s logging configuration and, where appropriate, read the file from inside the container or use the application’s own log shipping method. If the container is short-lived, remember that files inside its writable layer may disappear when the container is removed.
Use stdout and stderr deliberately
Official image documentation gives two concrete patterns. The nginx image routes access and error logs to /dev/stdout and /dev/stderr. The httpd image configures logging through /proc/self/fd/1 and /proc/self/fd/2. These are examples of configuring an application to expose logs through Docker’s streams; they are not a universal instruction to overwrite every application log file. Preserve file logging when the application requires it, but make the intended collection path explicit.
Do not confuse silence with success
Some programs log only on warnings or failures, and some buffer output. A quiet stream therefore needs context: check the application’s configured log level, whether the failing code path was actually exercised, and whether output is being redirected by a wrapper process. Docker can only display bytes that reach the configured logging pipeline.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCheck the logging driver
Docker’s logging driver determines where a container’s stdout and stderr are sent. A container can have a driver that differs from the daemon’s default, so inspect both values.
Inspect the container-specific driver
docker inspect -f '{{.HostConfig.LogConfig.Type}}' CONTAINERThis reports the logging driver recorded for that container at creation time. Inspecting the actual container matters more than assuming the current daemon default, especially after a configuration change or when a deployment tool supplied an explicit driver.
Inspect the daemon default
docker info --format '{{.LoggingDriver}}'This reports the daemon’s default driver for containers that are created without an overriding setting. It does not retroactively change existing containers. Treat the two commands as complementary: one explains this container, and the other explains what a newly created container would normally inherit.
Interpret an empty or unexpected result
- If the driver is
none, Docker does not make container logs available throughdocker logs. - If the driver sends output to a file, remote host, database, or another backend, the normal CLI stream may be limited or unavailable when dual logging is disabled.
- If the container-specific value differs from the daemon default, troubleshoot the container’s value; changing the default alone will not alter that existing container.
- If the driver is usable but the stream is empty, return to the application-output check: the process may be writing only to files.
- If a remote destination is unavailable, determine whether the driver buffers, drops, or blocks output according to that driver’s behavior and configuration; Docker’s generic command cannot substitute for checking the destination.
Compare Docker logging drivers and their operational consequences
Docker documents several destinations. The correct choice depends on where operators must read logs, whether the destination exists on the target platform, and who is responsible for retention, rotation, and storage. Also consider whether an outage in the destination should affect the application’s ability to write logs.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Driver | Primary destination or behavior | Operational implication |
|---|---|---|
json-file |
Host-side JSON log files; Docker’s documented default | No log rotation by default, so busy containers can consume host disk space. It remains the default for backward compatibility and Kubernetes-runtime use cases. |
local |
Docker’s local logging format | Docker recommends it for other situations because it rotates by default and is designed to reduce overhead and disk use. The documented default capacity is 100 MB per container, based on five rotated files of 20 MB each; defaults are version- and configuration-sensitive. |
none |
No container log collection | docker logs has no container output to display. |
journald |
The host’s systemd journal | Operators generally use host journal tooling and must account for journal retention and access permissions. |
syslog |
A syslog destination | Retention and availability are governed by the host or syslog receiver rather than Docker alone. |
fluentd |
A Fluentd endpoint | Requires a reachable Fluentd service and its own buffering, retention, and failure handling. |
awslogs |
An AWS logging destination | Depends on the target cloud configuration, credentials, connectivity, and retention policy. |
splunk |
A Splunk endpoint | Depends on a reachable receiver and the receiver’s storage and indexing policy. |
gcplogs |
A Google Cloud logging destination | Depends on the cloud project, permissions, connectivity, and configured retention. |
Why the default can fill a host disk
Docker documents json-file as having no rotation by default. A high-volume container can therefore accumulate large host-side files even when the application appears healthy. Disk exhaustion can then cause unrelated containers or the Docker daemon to fail. A full disk can also prevent new log records, making the original failure harder to reconstruct.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Why Docker recommends the local driver in other situations
Docker recommends local when you are not using a compatibility-driven json-file setup because local rotates by default and uses a more efficient format. The recommendation is about reducing overhead and disk-exhaustion risk, not a requirement to use one particular driver.
Changing the daemon default is not retroactive
A daemon logging configuration change applies to newly created containers. Existing containers retain the logging configuration used when they were created. Recreate a container after changing the intended default, and verify the new value with docker inspect. Plan this as a deployment change rather than assuming a daemon restart will convert old containers.
Think about retention and cost
Every destination has a retention decision. Local files consume host storage; system journals and syslog receivers have their own retention rules; remote and hosted destinations add connectivity, access-control, indexing, and storage responsibilities. Cloud or third-party systems may also introduce service and data-transfer costs. Docker’s driver documentation does not identify one universally best provider, so select a destination based on required retention, operator access, platform support, and the failure behavior you can operate.
Use events to establish when and how a container failed
When the last log line does not explain the failure, correlate the container with Docker’s server events:
docker events --filter 'container=NAME_OR_ID'The command reports events in real time. Look for lifecycle and health signals such as start, die, restart, health_status, and oom. These can distinguish an application exit from a restart loop, health-status transition, or out-of-memory event. Start the event watcher before reproducing the problem when timing matters.
The Docker CLI reference states that only the most recent 256 events are returned. If the incident is older than that window, the event stream may no longer contain it; use the application and host’s retained records as well. Events establish what Docker observed, but they do not replace the application’s own explanation of why it exited.
Separate an application failure from a Docker daemon failure
When Docker commands still work
If docker ps, docker inspect, and docker logs respond, the daemon is reachable. Focus first on the container process, its output streams, its logging driver, and the events associated with its lifecycle.
When the CLI cannot reach Docker
Start with:
docker infoThen check the host service state and verify that DOCKER_HOST points to the intended, reachable daemon. A wrong remote endpoint can make a healthy local installation appear unavailable, while a stopped or misconfigured host service prevents every container command from working. Check the endpoint before changing application configuration.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Consider daemon configuration conflicts
Docker documents configuration conflicts as a troubleshooting path. A setting supplied in more than one place can prevent the daemon from starting or cause it to reject its configuration. Check the daemon’s configured options and the host service definition when startup fails, rather than treating an empty container log as the primary symptom. Resolve the daemon’s startup error first; container-level commands cannot provide output from a daemon that is not running.
Consider memory exhaustion
Memory exhaustion can affect the daemon, containers, or both. An oom event associated with a container is useful evidence, but host-level memory pressure may also prevent reliable container startup and logging. Check host resource state alongside the container’s Docker events. Do not infer an application bug solely from an abrupt end of output when an OOM signal is present.
Find Docker daemon logs by platform
Linux Docker Engine
Docker documents this systemd command for Linux hosts:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
journalctl -xu docker.serviceDistribution-dependent system logs may contain additional daemon messages. The exact location and retention depend on the Linux distribution and its service configuration. Permissions can also determine whether a non-privileged operator can read the journal.
Docker Desktop on macOS
Docker Desktop runs Docker Engine inside its managed environment. Docker documents daemon and virtual-machine service output in a multiplexed init.log. The Desktop version and installation determine the exact path and packaging of that file, so use the diagnostics location documented for the installed release.
Docker Desktop with Windows containers or WSL2
For Docker Desktop using WSL2, Docker documents daemon and VM service output in the multiplexed init.log. Windows-container deployments use Windows Event Log for daemon diagnostics. Do not assume that a Linux journalctl command will reveal a Windows-container daemon problem. Keep the host platform and the active container mode in mind when choosing a diagnostic source.
A complete troubleshooting workflow
- Confirm the target: run
docker ps -aand copy the correct name or ID, including a stopped container. - Read recent output: run
docker logs --tail 100 CONTAINERto establish the latest visible error. - Follow a reproduction: run
docker logs --follow CONTAINERwhile reproducing the startup, request, or health-check failure. - Check the output boundary: determine whether the application writes to stdout and stderr or only to files inside the container.
- Inspect the driver: run
docker inspect -f '{{.HostConfig.LogConfig.Type}}' CONTAINER, then compare it withdocker info --format '{{.LoggingDriver}}'. - Account for driver behavior: treat
none, remote destinations, and disabled dual logging as possible reasons the normal CLI stream is absent or incomplete. - Correlate lifecycle events: run
docker events --filter 'container=NAME_OR_ID'and watch for exits, restarts, health changes, or OOM events. - Escalate to the host: if Docker commands cannot reach the daemon, check
docker info, the host service,DOCKER_HOST, memory pressure, and daemon configuration. - Read daemon diagnostics: use the platform-appropriate Linux journal, Desktop
init.log, or Windows Event Log. - Record the evidence: preserve the container identifier, driver value, recent output, event timing, and host symptoms before recreating or removing anything. This makes a later comparison possible if the failure recurs.
Common symptoms and the most likely next check
| Symptom | Likely boundary | Next action |
|---|---|---|
docker logs is empty but the application appears to run |
The application writes to files instead of stdout or stderr | Inspect the application logging configuration and its in-container files. |
The command reports no useful output and the driver is none |
Container logging is disabled | Change the logging configuration for future containers and recreate the affected container. |
| Output is sent elsewhere | A remote or host logging driver is in use, possibly without dual logging | Read the configured destination and verify its connectivity and retention. |
| The container exits and immediately starts again | Lifecycle failure or restart policy | Follow the stream during reproduction and correlate start, die, and restart events. |
| The host runs out of disk space | Unrotated json-file logs or another storage consumer |
Check the driver, retention policy, and host storage; consider the rotating local driver for newly created containers. |
| Every Docker command fails to connect | Daemon, host service, or endpoint problem | Run docker info, verify DOCKER_HOST, check the host service, and read platform-specific daemon logs. |
| Logs stop abruptly with an OOM event | Container or host memory exhaustion | Correlate the event with host memory state and investigate limits or competing workloads. |
| One service replica is failing while others work | Task-specific application or environment problem | Use service logs, identify the affected task, then inspect that container and its events individually. |
Operational practices that prevent recurring log failures
- Make the application’s intended diagnostic stream explicit: send operational messages to stdout and errors to stderr when Docker is the collection layer.
- Choose a driver whose destination, retention, rotation, and access model match the host and operating environment.
- Review storage behavior before deploying high-volume services. The documented
json-filedefault has no rotation, whilelocalrotates by default. - Remember that driver changes affect newly created containers. Include recreation in the change procedure and verify each container’s actual driver.
- Use
docker eventsduring an incident instead of relying on the final application log line alone; an OOM, restart, or health transition can explain why output stops. - Document separate daemon-log procedures for Linux Engine, Docker Desktop, WSL2-based environments, and Windows containers.
- Define who owns retention and access for every destination, including remote systems. A log that exists but cannot be retrieved during an incident is not an effective diagnostic process.
- Review the logging path after image or deployment changes. A new entrypoint, wrapper, or explicit driver can change what reaches
docker logswithout changing the application’s visible behavior.
Optional broader Docker learning
Viewing logs requires no physical accessory, repair item, or consumable. For readers who want broader Docker education rather than a dedicated log viewer, Docker Deep Dive: Zero to Docker in a Single Book, 2025 Edition, by Nigel Poulton, is an optional reference. It is not a prerequisite for the commands or troubleshooting sequence here.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Why does docker logs show nothing?
First verify that you selected the right container with docker ps -a. Then check whether the application writes to stdout or stderr. If it writes only to files, Docker’s stream can be empty. Finally inspect the container’s logging driver; none, a remote destination, or disabled dual logging can make the normal command unavailable or incomplete.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
How do I watch Docker logs in real time?
Run docker logs --follow CONTAINER, then reproduce the failure in another terminal. Stop following with Ctrl+C; that only ends the log view and does not stop the container.
How can I see logs from a stopped container?
Use docker ps -a instead of docker ps to find exited containers, then run docker logs CONTAINER or add --tail 100. Capture the output before removing the container.
Does Docker read /var/log/app.log automatically?
No. docker logs reads the endpoint process’s stdout and stderr. An application must route messages to those streams, or you must read and ship its files through another method.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I find which logging driver a container uses?
Run docker inspect -f '{{.HostConfig.LogConfig.Type}}' CONTAINER. To see the daemon default for newly created containers, run docker info --format '{{.LoggingDriver}}'. The container-specific setting takes precedence for an existing container.
Why did changing Docker’s default logging driver not fix an existing container?
Daemon defaults apply when containers are created. Existing containers retain the driver recorded at creation time. Recreate the container with the intended configuration, then verify it with docker inspect.
Which Docker logging driver should I choose?
Choose based on where operators need to read logs, platform support, retention, rotation, access, and failure handling. Docker documents json-file as the default but without rotation by default, and recommends local for other situations because it rotates by default and reduces overhead and disk-use risk. Remote drivers add destination, connectivity, permissions, retention, and potentially service-cost responsibilities.
How do I tell whether a container was killed for memory exhaustion?
Watch docker events --filter 'container=NAME_OR_ID' while reproducing the issue and look for an oom event. Check host memory pressure as well, because host-level exhaustion can affect both the daemon and containers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhere are Docker daemon logs on Linux?
For a Linux systemd installation, Docker documents journalctl -xu docker.service. Distribution-specific logs, retention, and permissions vary.
Where are Docker Desktop daemon logs on macOS or Windows?
Docker documents daemon and virtual-machine service output for Desktop and WSL2 environments in a multiplexed init.log; the exact location depends on the Desktop version and installation. Windows-container deployments use Windows Event Log.
How many Docker events can the CLI return?
The Docker CLI reference states that only the most recent 256 events are returned. For older incidents, use retained application and host records in addition to the live event stream.
The Bottom Line
Use docker logs for the container process’s stdout and stderr, not as a universal reader of files inside the container. If output is empty, verify the application’s logging path and the container’s actual driver before escalating. Then correlate docker events with the failure, and move to platform-specific daemon logs when the Docker service or host is the problem. Remember that driver defaults affect newly created containers only, and plan retention and rotation so logging does not become the next outage.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
