{"id":48419,"date":"2025-02-08T08:29:27","date_gmt":"2025-02-08T08:29:27","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=48419"},"modified":"2026-02-21T07:25:45","modified_gmt":"2026-02-21T07:25:45","slug":"docker-events","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/docker-events\/","title":{"rendered":"Docker commands Guide – docker events with examples"},"content":{"rendered":"\n

Here\u2019s a complete tutorial<\/strong> on docker events<\/code>, explaining what it does<\/strong>, a complete list of examples<\/strong>, and use cases<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

What is docker events<\/code>?<\/strong><\/h2>\n\n\n\n

docker events<\/code> is a Docker command that provides a real-time stream of events<\/strong> happening on your Docker daemon. It tracks container lifecycle events (e.g., start, stop, create, kill), network changes, image pulls, and more.<\/p>\n\n\n\n

Key Features:<\/strong><\/h3>\n\n\n\n
    \n
  • Monitors real-time activity<\/strong> on Docker.<\/li>\n\n\n\n
  • Helps with debugging, auditing, and automation<\/strong>.<\/li>\n\n\n\n
  • Supports filtering by event type, container name, image, and timestamp<\/strong>.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n

    Basic Syntax<\/strong><\/h2>\n\n\n
    docker<\/span> events<\/span> [OPTIONS]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Common Options:<\/strong><\/h3>\n\n\n\n
      \n
    • --filter<\/code>, -f<\/code>: Filter events by specific criteria (container, image, event type, etc.).<\/li>\n\n\n\n
    • --since<\/code>: Show events starting from a specific time (--since 10m<\/code> for last 10 minutes).<\/li>\n\n\n\n
    • --until<\/code>: Show events until a specific time (--until 2023-02-07T12:00:00<\/code>).<\/li>\n\n\n\n
    • --format<\/code>: Format the output using Go templates.<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n
      Examples of docker events<\/code><\/strong><\/h2>\n\n\n\n
      1. Show Real-Time Docker Events<\/strong><\/h3>\n\n\n
      docker events\n<\/code><\/span><\/pre>\n\n\n
      This streams all Docker events in real-time.<\/p>\n\n\n\n
      Example Output:<\/strong><\/p>\n\n\n
      2026-02-07T10:30:00.000000000Z container create a1b2c3d4e5f6 (name=my_container, image=nginx:latest)\n2026-02-07T10:30:05.000000000Z container start a1b2c3d4e5f6 (name=my_container)\n2026-02-07T10:35:00.000000000Z container stop a1b2c3d4e5f6 (name=my_container)\n<\/code><\/span><\/pre>\n\n\n
      \n\n\n\n
      2. Filter Events by Container Name<\/strong><\/h3>\n\n\n
      docker events --filter \"container=my_container\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This shows only events related to my_container<\/code>.<\/p>\n\n\n\n
      \n\n\n\n
      3. Show Events for a Specific Image<\/strong><\/h3>\n\n\n
      docker events --filter \"image=nginx\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This displays events triggered by any container running the nginx<\/code> image.<\/p>\n\n\n\n
      \n\n\n\n
      4. Filter Events by Event Type (start<\/code>, stop<\/code>, create<\/code>, etc.)<\/strong><\/h3>\n\n\n
      docker events --filter \"event=start\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This shows only start<\/code> events for containers.<\/p>\n\n\n\n
      \n\n\n\n
      5. Show Events from the Last 10 Minutes<\/strong><\/h3>\n\n\n
      docker events --since 10m\n<\/code><\/span><\/pre>\n\n\n
      This displays events that occurred in the last 10 minutes.<\/p>\n\n\n\n
      \n\n\n\n
      6. Show Events Within a Time Range<\/strong><\/h3>\n\n\n
      docker<\/span> events<\/span> --since<\/span> 2023-02-07T10<\/span>:00<\/span>:00<\/span> --until<\/span> 2023-02-07T10<\/span>:30<\/span>:00<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      This shows events that occurred between 10:00 AM<\/code> and 10:30 AM<\/code> on February 7, 2023.<\/p>\n\n\n\n
      \n\n\n\n
      7. Use Custom Formatting for Output<\/strong><\/h3>\n\n\n
      docker events --format '{{json .}}'<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This displays events in JSON format for easy parsing.<\/p>\n\n\n\n
      Example Output:<\/strong><\/p>\n\n\n
      {\"status\"<\/span>:\"create\"<\/span>,\"id\"<\/span>:\"a1b2c3d4e5f6\"<\/span>,\"from\"<\/span>:\"nginx:latest\"<\/span>,\"Type\"<\/span>:\"container\"<\/span>,\"time\"<\/span>:1675773000<\/span>}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      8. Monitor and Log Events to a File<\/strong><\/h3>\n\n\n
      docker<\/span> events<\/span> --since<\/span> 1h<\/span> > docker_events<\/span>.log<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      This saves all events from the last hour to a log file.<\/p>\n\n\n\n
      \n\n\n\n
      9. Watch Network Events<\/strong><\/h3>\n\n\n
      docker events --filter \"type=network\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This shows events related to Docker networks (e.g., network creation, connection, and disconnection).<\/p>\n\n\n\n
      \n\n\n\n
      10. Monitor Events for Multiple Filters<\/strong><\/h3>\n\n\n
      docker events --filter \"event=start\"<\/span> --filter \"event=stop\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      This displays only start<\/code> and stop<\/code> events for containers.<\/p>\n\n\n\n
      \n\n\n\n
      Use Cases for docker events<\/code><\/strong><\/h2>\n\n\n\n
      1. Real-Time Monitoring<\/strong><\/h3>\n\n\n\n
        \n
      • Monitor container lifecycle<\/strong> events to ensure services are running properly.<\/li>\n\n\n\n
      • Example: Detect when a container stops unexpectedly.<\/li>\n<\/ul>\n\n\n\n
        2. Debugging and Troubleshooting<\/strong><\/h3>\n\n\n\n
          \n
        • Track start, stop, and kill events<\/strong> to debug container issues.<\/li>\n\n\n\n
        • Example: Check if a container was killed due to resource limits or manually stopped.<\/li>\n<\/ul>\n\n\n\n
          3. Automation and Event-Driven Actions<\/strong><\/h3>\n\n\n\n
            \n
          • Integrate docker events<\/code> with automation tools to trigger actions<\/strong> based on events.<\/li>\n\n\n\n
          • Example: Automatically restart a container when it stops.<\/li>\n<\/ul>\n\n\n\n
            4. Auditing and Security Monitoring<\/strong><\/h3>\n\n\n\n
              \n
            • Audit Docker activity to detect unauthorized image pulls, container creations, or deletions<\/strong>.<\/li>\n\n\n\n
            • Example: Monitor network changes to detect unexpected behavior.<\/li>\n<\/ul>\n\n\n\n
              5. Resource Management and Scaling<\/strong><\/h3>\n\n\n\n
                \n
              • Track CPU and memory usage<\/strong> spikes using external tools combined with docker events<\/code>.<\/li>\n\n\n\n
              • Example: Trigger scaling actions based on high CPU usage.<\/li>\n<\/ul>\n\n\n\n
                6. Logging and Analytics<\/strong><\/h3>\n\n\n\n
                  \n
                • Combine with centralized logging tools to build custom dashboards and reports<\/strong>.<\/li>\n<\/ul>\n\n\n\n
                  \n\n\n\n
                  List of Common docker events<\/code> Commands<\/strong><\/h2>\n\n\n\n
                  Command<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
                  docker events<\/code><\/td>Show real-time Docker events<\/td><\/tr>
                  docker events --filter \"container=my_container\"<\/code><\/td>Filter events for a specific container<\/td><\/tr>
                  docker events --filter \"image=nginx\"<\/code><\/td>Show events for containers using the nginx<\/code> image<\/td><\/tr>
                  docker events --filter \"event=start\"<\/code><\/td>Show only container start<\/code> events<\/td><\/tr>
                  docker events --since 10m<\/code><\/td>Show events from the last 10 minutes<\/td><\/tr>
                  docker events --since 2026-02-07T10:00:00 --until 2026-02-07T10:30:00<\/code><\/td>Show events in a specific time range<\/td><\/tr>
                  docker events --filter \"type=network\"<\/code><\/td>Monitor network-related events<\/td><\/tr>
                  docker events --format '{{json .}}'<\/code><\/td>Show events in JSON format<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                  \n\n\n\n
                  Best Practices for Using docker events<\/code>:<\/strong><\/h2>\n\n\n\n
                    \n
                  1. Use filtering (--filter<\/code>)<\/strong> to avoid overwhelming output and focus on relevant events.<\/li>\n\n\n\n
                  2. Combine with external monitoring tools<\/strong> (e.g., Prometheus, Grafana) for advanced alerting and dashboards.<\/li>\n\n\n\n
                  3. Log events to a file<\/strong> for future reference or audits.<\/li>\n\n\n\n
                  4. Automate recovery actions<\/strong> based on container events (e.g., restart a failed container).<\/li>\n\n\n\n
                  5. Monitor network events<\/strong> to detect security incidents or misconfigurations.<\/li>\n<\/ol>\n\n\n\n
                    \n\n\n\n
                    Common Errors and Solutions<\/strong><\/h2>\n\n\n\n
                      \n
                    1. No output from docker events<\/code><\/strong>
                      \u2192 Ensure that Docker is running. Use docker ps<\/code> to verify.<\/li>\n\n\n\n
                    2. Too many events<\/strong>
                      \u2192 Use --filter<\/code> and --since<\/code> to reduce the output and focus on specific events.<\/li>\n\n\n\n
                    3. Event data is hard to parse<\/strong>
                      \u2192 Use --format '{{json .}}'<\/code> for structured JSON output.<\/li>\n<\/ol>\n\n\n\n
                      \n\n\n\n
                      Combining docker events<\/code> with Other Tools<\/strong><\/h2>\n\n\n\n
                      1. Automate Recovery with a Shell Script<\/strong><\/h3>\n\n\n
                      docker events --filter \"event=die\"<\/span> | while<\/span> read event; do<\/span>\n  docker start $(echo<\/span> $event | grep -o -E '[a-z0-9]{12}'<\/span>)\ndone\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                      Automatically restart any container that stops.<\/p>\n\n\n\n
                      2. Monitor Events and Send Alerts<\/strong><\/h3>\n\n\n\n
                      Integrate with tools like Prometheus<\/strong>, Grafana<\/strong>, or Slack<\/strong> to receive real-time alerts based on events.<\/p>\n\n\n\n
                      \n\n\n\n
                      <\/p>\n","protected":false},"excerpt":{"rendered":"
                      Here\u2019s a complete tutorial on docker events, explaining what it does, a complete list of examples, and use cases. What is docker events? docker events is a Docker command that… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[4862],"tags":[],"class_list":["post-48419","post","type-post","status-publish","format-standard","hentry","category-docker"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=48419"}],"version-history":[{"count":3,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48419\/revisions"}],"predecessor-version":[{"id":58890,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48419\/revisions\/58890"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=48419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=48419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=48419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}