Windows 10 and Docker container logs / Docker Logging driver

Question

I'm using Windows 10 with native docker installation.

I'm looking for the location where docker save the containers logs.
In Linux, the Docker containers log files are in this location:

/var/lib/docker/containers/container-id/container-id-json.log

But where can I find it in windows 10 ?

Answer 1

For me, on Windows 11 and WSL2, I found mine at:

\\wsl.localhost\docker-desktop-data\data\docker\containers\[container id]\[log id].json.log

You can find the container ID and the log ID from the inspect tab of the container in docker desktop.

Answer 2

For me, in 2024 using Docker Desktop on Windows (WSL2) the Docker Daemon's data-root was here:

\\wsl$\docker-desktop\tmp\docker-desktop-root\mnt\docker-desktop-disk\data\docker

You can then go into the "containers" folder, open the container you want and the logs will be in the <id>-json.log file.

Answer 3

Check first if those logs are in (as suggested here):

C:\ProgramData\docker\containers\[container_ID]\[container_ID]-json.log

2019: The Docker C:\ProgramData\docker is the Root Dir reported by docker info.
2020: DOCKER_ARTIFACTS == \\wsl$\docker-desktop-data\data\docker
(as mentioned in the comments by Ricardo Rivaldo, for Docker version 20.10+)
(See also "Locating data volumes in Docker Desktop (Windows)")

Regarding Docker Linux through Hyper-v, check if "How to Delete Docker Container Log Files (Windows or Linux) " can help (from Jon Gallant):

1. Run docker inspect to find your Docker log file location
2. Find the “Docker Root Dir” Value, mine is /var/lib/docker

Your docker log file path should be /var/lib/docker, but if it isn’t, then change it in the command below.

find /var/lib/docker/containers/ -type f -name "*.log"

The command you see in this image is based on "How to SSH into the Docker VM (MobyLinuxVM) on Windows"

We aren’t technically going to SSH into the VM, we’ll create a container that has full root access and then access the file system from there.

• Get container with access to Docker Daemon
• Run container with full root access
• Switch to host file system

Open a Command prompt and execute the following:

docker run --privileged -it -v /var/run/docker.sock:/var/run/docker.sock jongallant/ubuntu-docker-client 
docker run --net=host --ipc=host --uts=host --pid=host -it --security-opt=seccomp=unconfined --privileged --rm -v /:/host alpine /bin/sh
chroot /host

Execute the find command there, and you should find the logs.

Answer 4

If you use docker-compose with windows+wsl, In my case the log monitoring agent (also running as a container in docker) was not able to find the log files eventhough the path for logs was mounted as volume.

volumes:
   - /var/run/docker.sock:/var/run/docker.sock
   - /var/lib/docker:/var/lib/docker

The log monitoring agent could not find logs in

/var/lib/docker/containers/**/*.log

The problem in my case was, I was running docker-compose up command for the log monitoring agent from within wsl shell. When I ran it from windows powershell or cmd, the agent was able to find the logs in mounted path.

Answer 5

For Windows Users who wants to delete all Docker log files on WSL 2.

The path to the docker container is correct thx to @craftsmannadeem

\\wsl$\docker-desktop-data\version-pack-data\community\docker\containers

Here a command to execute on Windows to delete all log files:

del /s \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\*-json.log

Bye bye Docker logs:

File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\2012efd0ccfb8aed6291dd9a3b7b5aef507b6af4fce5b85e9306f45980db9531\2012efd0ccfb8aed6291dd9a3b7b5aef507b6af4fce5b85e9306f45980db9531-json.log
File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\9e627f1fe8f3c3ab85c64f85f93942d1f077e9a6e2896b51df782b0c0c3777d1\9e627f1fe8f3c3ab85c64f85f93942d1f077e9a6e2896b51df782b0c0c3777d1-json.log
File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\6ea8f3cb354c199bc719701f8f1e75c333f81cd2f03dca0c7a626cbcbf9ed5a0\6ea8f3cb354c199bc719701f8f1e75c333f81cd2f03dca0c7a626cbcbf9ed5a0-json.log
...

Answer 6

I couldn't find where the logs were stored locally. (Good chance they aren't plain text any more. However, if you just need the output of the logs, you can run a command like this:

docker logs --details [container-name] > container-name.log

This will grab the logs for the container and write them to a log file in the current directory.

Note: The --details adds additional info to the logs like environment variables and the like, but is not required for the command to work.

Answer 7

For me, using Docker Desktop for Windows on version 4.9.1 (81317), Windows 10 21H2, WSL 2 mode, the containers' folders were at

\\wsl$\docker-desktop-data\data\docker\containers

Slightly different from the others.

Answer 8

For window system logs are located at C:\ProgramData\Docker\containers or %APPDATA%\Docker For Linux system logs are located at /var/lib/docker/containers

Answer 9

For Windows 10 + Docker Desktop version 3.6.0, the virtual path for logs and data (artifacts) is \\wsl$\docker-desktop-data\version-pack-data\community\docker (you can copy/paste it in Explorer navigation bar).

The logs are at \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\[containerID]\[containerID]-json.logs

and the data is under \\wsl$\docker-desktop-data\version-pack-data\community\docker\volumes\[volumeID]\_data

How to get containerID:

You can find container ID (truncated) by running docker ps in a command prompt. You can also find it by clicking the CLI button on DockerDesktop next to the container name, the id will be in the title of the cmd window that will pop up. Once you have the id, you can navigate to containers\[containerID] under the artifacts directory (\\wsl$\docker-... above). The log file will have the .log extension and its name will have the containerID in it. Keep in mind that it will be an enriched json format though, so not easily readable.

How to get volumeID:

To find a container's data (for example kafka broker topics), you need to find the id of the volumes where the data is stored. For that you will need to click on the container in DockerDesktop, then click INSPECT (top right). You can then scroll down to find Mounts configuration entries. Each mount will have a volumeID (different from containerID), and that volumeID will be part of a path similar to this one /var/lib/docker/volumes/71f7a5992c58fdcf229c3848acb014712f34fab380bc7c712cf5a0a632fe9110/_data. volumeID here being 71f7a5992c58fdcf229c3848acb014712f34fab380bc7c712cf5a0a632fe9110. You can then take volumeID and navigate to volumes\[volumeID] under the artifacts directory (\\wsl$\docker-... above) where the data will be located.

Answer 10

For Windows 10 + WSL 2 (Ubuntu 20.04), Docker version 20.10.2, build 2291f61

Lets DOCKER_ARTIFACTS == \\wsl$\docker-desktop-data\version-pack-data\community\docker

Container logs can be found in the following location

DOCKER_ARTIFACTS\containers\[Your_container_ID]\[Your_container_ID]-json.log

Here is an example :