How to Real-Time Monitor a Docker Host

If you have a Docker container host, many events are happening every second on your host that you can review and filter in real-time.

We can use the docker events command to get started with real-time monitoring of events on a Docker host. At the most basic form of the command, you will a real-time flow of events by running.

docker events

To output looks like

2021-08-06T22:30:47.730242430+10:00 network connect a578f5ef67d24b4d6563ed973aafaf7bb4d7f681072c652bdcda851fbff31302 (container=c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815, name=bridge, type=bridge)
2021-08-06T22:30:48.154745474+10:00 container start c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815 (desktop.docker.io/wsl-distro=Ubuntu, image=python, name=deploy01)

Filter

If the default command is too noisy, we can use the filter option to look for more specific events. Filtering is done using a key=value filter.

To filter the events from a single container, we can use the following command.

docker events --filter container=deploy01

Note: Multiple filters will produce an OR statement, and multiple different filters will produce an AND filter.

To view all the stop or start events, we can use the following filter.

docker events --filter event=start

We can also use the time-based filtering using the –since or –until options (date, minutes) as follow.

docker events --since "15m"

Formating

We can also format the output into sections that make everything clearer.

docker events --since "15m"   --filter 'container=deploy01' --format '
Type={{.Type}} Status={{.Status}}  ID={{.ID}}'

Type=container Status=kill  ID=c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815
Type=container Status=die  ID=c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815
Type=container Status=stop  ID=c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815
Type=container Status=start  ID=c5719302e047655e7d4bf46b505d4da017548f492245571c8bded427958aa815