Logging & Monitoring

# The basic command — stream logs from a running container
docker logs payment-api
# Outputs everything the container has written to stdout and stderr
# since it started. Follows the same order the process wrote it.

# Follow logs in real time (like tail -f):
docker logs -f payment-api

# Show only the last N lines:
docker logs --tail 100 payment-api

# Filter by time — logs since a specific point:
docker logs --since 2h payment-api
docker logs --since 2024-01-15T02:00:00 payment-api

# Include timestamps (Docker adds them, the app doesn't need to):
docker logs -t payment-api

# Combine flags — last 50 lines with timestamps, live follow:
docker logs -f -t --tail 50 payment-api

# Set log rotation on a single container:
docker run -d \
  --name payment-api \
  --log-driver json-file \
  --log-opt max-size=10m \
  --log-opt max-file=5 \
  -p 3000:3000 \
  payment-api:v1.2.0
# max-size=10m  → each log file is capped at 10 MB
#                 when the file hits 10 MB it is rotated
# max-file=5   → keep at most 5 rotated files
#                 total maximum disk usage: 10m × 5 = 50 MB per container
#                 the oldest file is deleted when a 6th would be created

# Set log rotation globally for all containers on the host.
# Edit /etc/docker/daemon.json (create it if it doesn't exist):
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "5"
  }
}
# Restart the Docker Daemon to apply:
sudo systemctl restart docker
# All new containers on this host now inherit these defaults automatically.
# Existing containers are unaffected — they must be recreated to pick up the change.

# Send logs to a remote syslog server:
docker run -d \
  --name payment-api \
  --log-driver syslog \
  --log-opt syslog-address=tcp://logs.acmecorp.internal:514 \
  --log-opt syslog-facility=daemon \
  --log-opt tag="payment-api/{{.ID}}" \
  -p 3000:3000 \
  payment-api:v1.2.0
# syslog-address  → the remote syslog server — TCP for reliability over UDP
# syslog-facility → categorises the log source for the syslog server
# tag             → identifies the container in the syslog stream
#                   {{.ID}} is replaced with the container ID at runtime

# Send logs to AWS CloudWatch Logs:
docker run -d \
  --name payment-api \
  --log-driver awslogs \
  --log-opt awslogs-region=ap-south-1 \
  --log-opt awslogs-group=/acmecorp/production/payment-api \
  --log-opt awslogs-stream=payment-api-1 \
  -p 3000:3000 \
  payment-api:v1.2.0
# awslogs-group   → the CloudWatch log group (created automatically if absent)
# awslogs-stream  → the stream within that group — typically one per container

version: "3.8"

services:
  api:
    image: payment-api:v1.2.0
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    ports:
      - "3000:3000"

  db:
    image: postgres:15-alpine
    logging:
      driver: json-file
      options:
        max-size: "20m"
        # Databases can be chattier — give them more room before rotation
        max-file: "3"
    volumes:
      - pgdata:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    logging:
      driver: json-file
      options:
        max-size: "5m"
        max-file: "3"

volumes:
  pgdata:

// Plain text — readable but impossible to query at scale:
console.log(`POST /payment 200 42ms user=u_8821 order=ord_4492`);

// Structured JSON — every field is queryable:
console.log(JSON.stringify({
  level:    "info",
  msg:      "payment processed",
  method:   "POST",
  path:     "/payment",
  status:   200,
  ms:       42,
  userId:   "u_8821",
  orderId:  "ord_4492",
  ts:       new Date().toISOString()
}));
// Docker captures this line to stdout exactly as written.
// CloudWatch, Splunk, Datadog, Loki — any aggregator can now:
// • Filter all errors: level="error"
// • Measure p99 latency: avg(ms) where path="/payment"
// • Alert on failures: count(status=500) > 10 in 1 minute
// None of this is possible with plain text.

# Real-time view of all containers:
docker stats

# Snapshot for scripts and alerting:
docker stats --no-stream

# Custom format — output only what matters:
docker stats --no-stream \
  --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.NetIO}}"

# Check a specific container:
docker stats payment-api --no-stream

# Check how many times the container has restarted:
docker inspect payment-api | grep -i restartcount
"RestartCount": 3,
# This container has crashed and been restarted 3 times.

# View logs from the PREVIOUS run — the one that crashed:
docker logs --previous payment-api
# or shorthand:
docker logs -p payment-api
# This is the crash log. These are the lines written before the fatal exit.
# Without this flag, you only see the current (post-restart) run.

# Check the exit code of the last crash:
docker inspect payment-api \
  --format '{{.State.ExitCode}} — {{.State.Error}}'
137 — (signal: killed)
# Exit code 137 = OOM kill (128 + signal 9)
# Exit code 1   = application error
# Exit code 0   = clean shutdown
# Exit code 143 = SIGTERM — Docker asked it to stop gracefully