如何检查 Docker 日志？

Docker，一种流行的操作系统级虚拟化平台，它允许我们在称为容器的包中交付应用程序，简单来说，容器是具有自己的软件、库和配置文件的隔离环境。

与任何其他现代软件一样，记录事件和消息（如警告和错误）是 Docker 平台的固有部分，它允许您调试应用程序和生产问题。

我们将介绍一些管理和监控容器日志的简单方法。 让我们开始吧。

Docker 日志命令

获取容器日志的基本语法是：

 $ docker logs [OPTIONS] <CONTAINER-NAME OR ID>

或者

$ docker container logs [OPTIONS] <CONTAINER-NAME OR ID>

这两种语法本质上是相同的，因此我们将重点关注本文中的其余命令，即docker logs 。

但请注意，上述命令仅适用于使用json-file或journald日志驱动程序启动的容器。

这里的OPTIONS是指可用的docker logs命令支持的标志，如下所列：

例子：

 $ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 28913415ed22 nginx "/docker-entrypoint.…" 2 seconds ago Up 1 second 80/tcp gifted_edison $ docker logs 28913415ed22 /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh /docker-entrypoint.sh: Configuration complete; ready for start up 2021/08/28 09:02:59 [notice] 1#1: using the "epoll" event method 2021/08/28 09:02:59 [notice] 1#1: nginx/1.21.1 2021/08/28 09:02:59 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 2021/08/28 09:02:59 [notice] 1#1: OS: Linux 5.8.0-1039-azure 2021/08/28 09:02:59 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576 2021/08/28 09:02:59 [notice] 1#1: start worker processes 2021/08/28 09:02:59 [notice] 1#1: start worker process 31 2021/08/28 09:02:59 [notice] 1#1: start worker process 32 $

Docker 日志位置

默认情况下，Docker 会捕获所有容器的标准输出（和标准错误），并使用 JSON 格式将它们写入文件中。 这是使用 JSON 文件日志记录驱动程序或 json-file 实现的。 这些日志默认存储在/var/lib/docker文件系统下的容器特定位置。

 /var/lib/docker/containers/<container_id>/<container_id>-json.log

例如，对于下面列出的redis容器，我可以检查其json日志文件，如下面的代码段所示：

 $ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 551c9273bbea redis "docker-entrypoint.s…" 19 minutes ago Up 19 minutes 6379/tcp redis 6cc871763df1 nginx "/docker-entrypoint.…" 7 hours ago Up 7 hours 0.0.0.0:8080->80/tcp, :::8080->80/tcp nostalgic_wescoff $ sudo ls -l /var/lib/docker/containers/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73-json.log -rw-r----- 1 root root 1437 Aug 28 16:53 /var/lib/docker/containers/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73-json.log $ sudo tail -10 /var/lib/docker/containers/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73/551c9273bbea6eaf66523ed735866b9ebe6924c3b504dfeb44bef90e69d59c73-json.log {"log":"1:C 28 Aug 2021 16:53:42.160 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo\n","stream":"stdout","time":"2021-08-28T16:53:42.16031257Z"} {"log":"1:C 28 Aug 2021 16:53:42.160 # Redis version=6.2.5, bits=64, commit=00000000, modified=0, pid=1, just started\n","stream":"stdout","time":"2021-08-28T16:53:42.160337871Z"} {"log":"1:C 28 Aug 2021 16:53:42.160 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf\n","stream":"stdout","time":"2021-08-28T16:53:42.160342171Z"} {"log":"1:M 28 Aug 2021 16:53:42.160 * monotonic clock: POSIX clock_gettime\n","stream":"stdout","time":"2021-08-28T16:53:42.160792578Z"} {"log":"1:M 28 Aug 2021 16:53:42.161 * Running mode=standalone, port=6379.\n","stream":"stdout","time":"2021-08-28T16:53:42.161148683Z"} {"log":"1:M 28 Aug 2021 16:53:42.161 # Server initialized\n","stream":"stdout","time":"2021-08-28T16:53:42.161170984Z"} {"log":"1:M 28 Aug 2021 16:53:42.161 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.\n","stream":"stdout","time":"2021-08-28T16:53:42.161186984Z"} {"log":"1:M 28 Aug 2021 16:53:42.161 * Ready to accept connections\n","stream":"stdout","time":"2021-08-28T16:53:42.161484389Z"} $

显示额外细节

要显示提供给日志的额外详细信息，请使用--details标志。

例子：

 $ docker logs 6cc871763df1 --details /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh /docker-entrypoint.sh: Configuration complete; ready for start up 2021/08/28 10:29:05 [notice] 1#1: using the "epoll" event method 2021/08/28 10:29:05 [notice] 1#1: nginx/1.21.1 2021/08/28 10:29:05 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 2021/08/28 10:29:05 [notice] 1#1: OS: Linux 5.8.0-1039-azure 2021/08/28 10:29:05 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576 2021/08/28 10:29:05 [notice] 1#1: start worker processes 2021/08/28 10:29:05 [notice] 1#1: start worker process 33 2021/08/28 10:29:05 [notice] 1#1: start worker process 34 172.17.0.1 - - [28/Aug/2021:10:29:26 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" $

跟踪日志输出

您可以使用--follow或-f标志来跟踪日志输出。 这允许您从持续的STDOUT和STDERR监视日志流中的新更新。

例子：

 $ docker logs 6cc871763df1 -f /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh /docker-entrypoint.sh: Configuration complete; ready for start up 2021/08/28 10:29:05 [notice] 1#1: using the "epoll" event method 2021/08/28 10:29:05 [notice] 1#1: nginx/1.21.1 2021/08/28 10:29:05 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 2021/08/28 10:29:05 [notice] 1#1: OS: Linux 5.8.0-1039-azure 2021/08/28 10:29:05 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576 2021/08/28 10:29:05 [notice] 1#1: start worker processes 2021/08/28 10:29:05 [notice] 1#1: start worker process 33 2021/08/28 10:29:05 [notice] 1#1: start worker process 34 172.17.0.1 - - [28/Aug/2021:10:29:26 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-"

尾部日志

容器日志可以使用--tail或-n标志来限制屏幕上显示的输出数量。 默认情况下，此标志假定all作为显示完整日志流的参数。 要从日志末尾显示固定数量的行，请在--tail或-n标志后面指定一个正整数。

例子：

 $ docker logs 6cc871763df1 -n 10 /docker-entrypoint.sh: Configuration complete; ready for start up 2021/08/28 10:29:05 [notice] 1#1: using the "epoll" event method 2021/08/28 10:29:05 [notice] 1#1: nginx/1.21.1 2021/08/28 10:29:05 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 2021/08/28 10:29:05 [notice] 1#1: OS: Linux 5.8.0-1039-azure 2021/08/28 10:29:05 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576 2021/08/28 10:29:05 [notice] 1#1: start worker processes 2021/08/28 10:29:05 [notice] 1#1: start worker process 33 2021/08/28 10:29:05 [notice] 1#1: start worker process 34 172.17.0.1 - - [28/Aug/2021:10:29:26 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" $

显示日志

我们可以通过使用--since标志并给出一个时间戳，如使用语法2021-08-28T15:23:37Z的绝对值或相对的56m等 56 分钟来限制日志输出。

--since选项仅显示给定日期之后生成的容器日志。 您可以将日期指定为 RFC 3339 日期、UNIX 时间戳或 Go 持续时间字符串（例如1m30s 、 3h ）。 如果您未在时间戳末尾提供Z或+-00:00时区偏移量，则将使用客户端上的本地时区。 您可以将--since选项与--follow或--tail选项之一或两者结合使用。

例子：

 $ docker logs --since=1m nostalgic_wescoff 172.17.0.1 - - [28/Aug/2021:15:19:24 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" 172.17.0.1 - - [28/Aug/2021:15:19:25 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" $

在上面的示例中，只显示了 2 分钟以来的日志，其中nostalgic_wescoff是为nginx容器分配的自动生成的名称。

显示日志直到

与--since标志一样， --since docker logs也支持--until标志，它显示给定时间戳之前的日志。 类似地，时间戳遵循与之前类似的约定，可以使用语法2021-08-28T15:23:37Z或相对值（如56m持续 56 分钟）指定为绝对值。

例子：

 $ docker logs --until=1h30m nostalgic_wescoff /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/ /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh 10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf 10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh /docker-entrypoint.sh: Configuration complete; ready for start up 2021/08/28 10:29:05 [notice] 1#1: using the "epoll" event method 2021/08/28 10:29:05 [notice] 1#1: nginx/1.21.1 2021/08/28 10:29:05 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 2021/08/28 10:29:05 [notice] 1#1: OS: Linux 5.8.0-1039-azure 2021/08/28 10:29:05 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576 2021/08/28 10:29:05 [notice] 1#1: start worker processes 2021/08/28 10:29:05 [notice] 1#1: start worker process 33 2021/08/28 10:29:05 [notice] 1#1: start worker process 34 172.17.0.1 - - [28/Aug/2021:10:29:26 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" $

在上面的示例中，显示了 1 小时 30 分钟之前的所有日志。

显示时间戳

许多容器应用程序在其日志输出中提供时间戳，因此 Docker 还使用docker logs命令显示它们。 如果您需要 Docker 在输出中明确为其时间戳添加前缀，请使用--timestamps或-t标志。

例子：

 $ docker logs -t redis 2021-08-28T16:53:42.160312570Z 1:C 28 Aug 2021 16:53:42.160 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo 2021-08-28T16:53:42.160337871Z 1:C 28 Aug 2021 16:53:42.160 # Redis version=6.2.5, bits=64, commit=00000000, modified=0, pid=1, just started 2021-08-28T16:53:42.160342171Z 1:C 28 Aug 2021 16:53:42.160 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf 2021-08-28T16:53:42.160792578Z 1:M 28 Aug 2021 16:53:42.160 * monotonic clock: POSIX clock_gettime 2021-08-28T16:53:42.161148683Z 1:M 28 Aug 2021 16:53:42.161 * Running mode=standalone, port=6379. 2021-08-28T16:53:42.161170984Z 1:M 28 Aug 2021 16:53:42.161 # Server initialized 2021-08-28T16:53:42.161186984Z 1:M 28 Aug 2021 16:53:42.161 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect. 2021-08-28T16:53:42.161484389Z 1:M 28 Aug 2021 16:53:42.161 * Ready to accept connections $

合并标志

Docker 提供组合某些标志以获得更多过滤输出，而不是在屏幕上打印所有日志内容。 作为一个简单的例子，我们可以将--tail标志与--since结合使用以获得更多限制的输出。

例子：

 $ docker logs --since=2h -f nostalgic_wescoff 172.17.0.1 - - [28/Aug/2021:15:19:24 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" 172.17.0.1 - - [28/Aug/2021:15:19:25 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-"

这也可以与其他标志一起使用。

使用 Shell 实用程序过滤

Linux shell 实用程序也可用于提高日志输出的灵活性。 诸如grep 、 head 、 tail等实用程序可以通过管道传输到docker logs输出以进行更高级的操作。

例子：

 $ docker logs --since=7h nostalgic_wescoff 2>&1 | grep GET 172.17.0.1 - - [28/Aug/2021:10:29:26 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" 172.17.0.1 - - [28/Aug/2021:15:19:24 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" 172.17.0.1 - - [28/Aug/2021:15:19:25 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.68.0" "-" $

请注意，我们需要重定向日志流以使用2>&1为grep提供单管道输入。

概括

Docker 是一个多功能平台，提供了许多功能来管理其环境。 管理系统日志是每个系统管理员都应该知道的基本技能之一。 一旦您根据您的要求了解可用命令和可能的标志，在 Docker 中管理日志就很容易了。

如需进一步了解 Docker 及其功能，请参阅 Docker 的文档。