Where Are Docker Logs Stored?
Tags: docker, devops, logs, showdev
Published: 2020-05-05 14:57:28

There’s a short answer, and a long answer. The short answer, that will satisfy your needs in the vast majority of cases, is:


```
/var/lib/docker/containers/<container_id>/<container_id>-json.log
```


From here you need to [ship logs](https://github.com/sematext/logagent-js) to a [central location](https://sematext.com/logsene/), and [enable log rotation](https://www.freecodecamp.org/news/how-to-setup-log-rotation-for-a-docker-container-a508093912b2/) for your Docker containers. Let me elaborate on _why_ with the long answer below. 


## Where Are Docker Container Logs Stored by Default?

You see, by default, Docker containers emit logs to the `stdout` and `stderr` output streams. **Containers are stateless**, and the **logs are stored on the Docker host in JSON files by default**.

Why? 

The **default logging driver is [json-file](https://docs.docker.com/config/containers/logging/json-file/)**. What’s a logging driver? 

A logging driver is a mechanism for getting info from your running containers. Here’s a more elaborate explanation from the [Docker docs](https://docs.docker.com/config/containers/logging/configure/). There are several different log drivers you can use except for the default json-file, like syslog, [journald](https://sematext.com/docs/integration/journald-integration/), fluentd, or [logagent](https://github.com/sematext/logagent-js).

These logs are emitted from output streams, annotated with the log origin, either `stdout` or `stderr`, and a timestamp. Each log file contains information about only one container and is in JSON format. Remember, **one log file per container**.

You find these JSON log files in the `/var/lib/docker/containers/` directory on a Linux Docker host. The `<container_id>` here is the id of the running container. 


```
/var/lib/docker/containers/<container_id>/<container_id>-json.log
```


If you’re not sure which id is related to which container, you can run the `docker ps` command to list all running containers. The container id is located in the first column.


```bash
docker ps

[Output]
CONTAINERID  IMAGE     COMMAND       CREATED    STATUS    PORTS    NAMES
cf74b6fce535 foo_image "node app.js" X min ago  Up X min  3000/tcp foo_app
```


Now you know where the container logs are stored, and you can continue to troubleshoot and debug any issues that come up.

That’s where [logging](https://sematext.com/guides/docker-logs/) comes into play. You collect the logs with a log aggregator and store them in a place where they’ll be available forever. It’s dangerous to keep logs on the Docker host because they can build up over time and eat into your disk space. That’s why you should use a [central location](https://sematext.com/logsene/) for your logs and [enable log rotation](https://www.freecodecamp.org/news/how-to-setup-log-rotation-for-a-docker-container-a508093912b2/) for your Docker containers.


## Debugging Docker Issues with Container Logs

Docker has a [dedicated API](https://docs.docker.com/config/containers/logging/) for working with logs. But, keep in mind, it will only work if you use the json-file log driver. I strongly recommend not changing the log driver! Let’s start debugging.

First of all, to list all running containers, use the `docker ps` command. 


```bash
docker ps
```


Then, with the `docker logs` command you can list the logs for a particular container.


```bash
docker logs <container_id>
```


Most of the time you’ll end up tailing these logs in real time, or checking the last few logs lines.

Using the `--follow` or `-f` flag will `tail -f` (follow) the Docker container logs:


```bash
docker logs <container_id> -f
```


The `--tail` flag will show the last number of log lines you specify:


```bash
docker logs <container_id> --tail N
```


The `-t` or `--timestamp` flag will show the timestamps of the log lines:


```bash
docker logs <container_id> -t
```


The `--details` flag will show extra details about the log lines:


```bash
docker logs <container_id> --details
```


But what if you only want to see specific logs? Luckily, grep works with Docker logs as well.


```bash
docker logs <container_id> | grep pattern
```


This command will only show errors:


```bash
docker logs <container_id> | grep -i error
```


Once an application starts growing, you tend to start using Docker Compose. Don’t worry, it has a logs command as well.

```bash
docker-compose logs
```

This will display the logs from all services in the application defined in the Docker Compose configuration file.


## Storing Docker Container Logs in a Central Location Using a Log Shipper

With your infrastructure growing, you can rely on just using the Docker API to troubleshoot logs. You need to store all logs in a secure place, so you can analyze and troubleshoot any issues after-the-fact. 

![](https://sematext.com/wp-content/uploads/2020/04/post-docker-logs-location-image2.png)

You need a steady influx of logs so you can get actionable insight into what is happening to your Docker containers. Setting up log rotation is just step one.

By storing logs in one place you can also set up alerts that notify you if anything breaks, or whenever you’re experiencing unexpected behavior.

Container logs can be a mix of plain text messages from start scripts and structured logs from applications, which makes it difficult for you to tell which log event belongs to what container and application.

Although Docker log drivers can ship logs to [log management tools](https://www.google.com/url?q=https://sematext.com/blog/best-log-management-tools/&sa=D&ust=1586240114907000&usg=AFQjCNHdp-WqXp3pySyzyw3A-xEZ00LvJA), most of them don’t allow you to parse container logs. You need a separate tool called a log shipper, such as [Logagent](https://sematext.com/blog/docker-container-monitoring-with-sematext/#toc-getting-started-with-logagent-1), [Logstash or rsyslog](https://sematext.com/blog/logstash-alternatives/) to structure and enrich the logs before shipping them.

The solution is to have a container dedicated solely to logging and collecting logs. You deploy the dedicated logging container within your Docker environment. It will automatically [aggregate logs](https://sematext.com/blog/log-aggregation/) from all containers, as well as monitor, [analyze,](https://sematext.com/blog/log-analysis/) and store or forward them to a central location. 

This makes it easier to move containers between hosts and easily scale your infrastructure. It also lets you collect logs through various streams, including log events, Docker API data, stats, etc. 

This is what I’d suggest you use. By far the most reliable and convenient way of log collection is to use the json-file driver and set up a log shipper to ship the logs. You always have a local copy of logs on your server and you get the [advantage of centralized log management](https://sematext.com/guides/log-management/). 

If you were to use [Sematext Logagent](https://sematext.com/docs/logagent/installation-docker/) there are a [few simple steps](https://sematext.com/blog/docker-container-monitoring-with-sematext/#toc-getting-started-with-logagent-1) to follow in order to start sending logs to Sematext. After[ creating a Logs App](https://sematext.com/docs/logs/quick-start/#creating-a-logs-app), run these commands in a terminal.


```bash
docker pull sematext/logagent

docker run -d --restart=always --name st-logagent \
  -e LOGS_TOKEN=YOUR_LOGS_TOKEN \
  -e LOGS_RECEIVER_URL="https://logsene-receiver.sematext.com" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  sematext/logagent
```

This will start sending all container logs to Sematext. 

You can read more about how Logagent works and how to use it for monitoring logs in our post on [Docker Container Monitoring with Sematext](https://sematext.com/blog/docker-container-monitoring-with-sematext/#toc-container-logs-0). 


## Conclusion

There we go, both a short and long answer to where Docker Container logs are stored. By default, Docker uses the json-file log driver that stores logs in dedicated directories on the host:

```
/var/lib/docker/containers/<container_id>/<container_id>-json.log
```

The long answer, and what I’d suggest you do, is to set up a dedicated logging container that will structure and enrich your container logs, then send them to a central location. This makes troubleshooting and searching through logs much easier. But, you also get [alerting](https://sematext.com/alerts/) which is the main point. You want to know what breaks before your users do.

_Hope you guys and girls enjoyed reading this as much as I enjoyed writing it. If you liked it, feel free to hit the share button so more people will see this tutorial. Until next time, be curious and have fun._