# How to View Docker Logs: Tail, Follow and Compose Guide

> How to view docker logs for beginners: tail, follow, since, timestamps, docker compose logs, a restarting container, and max-size log rotation.

URL: https://www.matthewswong.com/en/blog/cara-melihat-docker-logs-untuk-pemula/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Published: 2026-10-17
- Updated: 2026-10-17
- Category: DevOps

> **Key takeaway:** To view docker logs, run docker logs --tail 50 container-name for the last 50 lines, add -f to follow live output and --since 10m to limit the time window. For Compose projects use docker compose logs web. If a container keeps restarting, read its log first, and cap log size with max-size and max-file.

Your container is running, but the page will not load, or its status keeps flipping to Restarting. You type docker logs container-name and the terminal floods with thousands of lines scrolling too fast to read. Beginners usually get stuck at three points: not knowing the correct container name, not knowing how to limit the output, and not knowing that a container that has already died can still have its log read.

This guide walks you through seven steps, from finding the container name to capping log size so the disk does not fill up. I checked every command and flag against the official Docker documentation, and the examples use the placeholder name web for both container and service. The last pattern in the guide matches this site's own docker-compose.yml: the json-file driver with max-size 10m and max-file 3.

Want to understand first where a log line goes and who stores it? Take the free lesson

Docker Logs for Beginners: Read, Cap and Rotate Logs

 in the DevOps from zero track, with an interactive explainer.

## What you need

Not much. Have these three things ready before you start.

Docker installed on your computer or server, and the docker command works in your terminal.

At least one container that is running or has run. The examples use the name web; replace it with your own.

For step 5, a Docker Compose project with a service named web. If you do not have one, you can still follow the other steps.

## Step 1: Find the right container name

Every log command needs a container name or ID. Run docker ps with -a, because without -a Docker lists only running containers and a dead one stays invisible.

Look at the STATUS column. Up means healthy, Restarting means Docker is starting it again because of its restart policy, and Exited followed by a number means the process finished or died with that code. Copy the NAMES column for the next step.

## Step 2: Read logs with docker logs and --tail

The basic command is docker logs container-name, and by default it shows every line from the beginning. For a container that has been up a long time that is far too much. Add --tail or -n to see only the last lines.

Docker captures the standard output and standard error of the container's main process, so what you see is what the app prints. If the app writes to its own log file, docker logs can look empty. Point the app at stdout and stderr.

## Step 3: Follow logs live with -f

When you are testing something, such as opening a page and watching the error appear, use --follow or -f. Docker keeps streaming new lines to the terminal. Combine it with --tail so you start from the latest context rather than the whole history.

Ctrl+C only stops the view in your terminal. The container keeps running. Beginners often hesitate to press it because they think the app will die too.

## Step 4: Narrow down with --since and --timestamps

When the problem happened a few minutes ago, --since shows only lines newer than a point in time. The value can be a duration like 10m or 3h, an RFC 3339 date, or a UNIX timestamp. --until is its counterpart for the end of the window, and --timestamps puts the time in front of every line.

If you leave the time zone out of an absolute value, the client uses your computer's local time zone. Add Z at the end when you want UTC, especially when comparing with logs from a server in a different zone.

## Step 5: Use docker compose logs for Compose projects

If the containers were created with Docker Compose, use docker compose logs. It takes service names, meaning the names in the compose file, not container_name. With no service name it shows every service at once, with the service name as a prefix on each line.

The flags are similar: --follow, --tail, --since, --until and --timestamps, plus --no-log-prefix to drop the prefix. Note that --tail applies per container and its default is all lines, so get into the habit of writing it.

## Step 6: Read a container that keeps restarting

A container that crashes and is started again by its restart policy is the most common case that makes beginners panic. In docker ps -a its status flips between Restarting and Exited. Stay calm: the log of the previous attempt is still there, and that is where the cause is written. Run the three commands below in order.

Look for the first error in an attempt, not the last line. The last line is usually just the result, for example the process exiting because of missing configuration. Docker's documentation also explains that a restart policy only takes effect once a container has been up for at least 10 seconds, so a container that can never start does not enter a restart loop.

> Do not delete a crashing container (docker rm) before reading its log. json-file logs are stored per container, so removing the container removes the evidence you are looking for. Read and copy the important part first.

## Step 7: Check the driver and cap the log size

Docker uses the json-file driver by default, and it does not rotate logs unless you configure it. On a server that runs for months, a single ever-growing log file can fill the disk. Check a container's driver with docker inspect, then cap it with the logging block in the compose file. The max-size and max-file values must be strings, so they are written in quotes.

With max-size 10m and max-file 3, Docker keeps at most three files of about 10 MB, and the oldest is deleted when a new one is created. The setting only applies to containers created afterwards. Existing containers keep their old options, so re-create the container with docker compose up -d --force-recreate.

## Common errors and how to fix them

Six symptoms that most often confuse beginners when reading container logs.

| Symptom | Cause | Fix |
| --- | --- | --- |
| docker logs prints nothing although the container is running | The app writes to its own log file, not to stdout and stderr. | Point the app at stdout and stderr, or link its log file to them like the official nginx image does. |
| The terminal floods with thousands of lines | --tail was not set, and its default is all lines. | Add --tail 50, or --since 10m to limit the time window. |
| No such container when running docker logs | Wrong name, or the container was removed. Without -a on docker ps, dead containers are hidden. | Check the name with docker ps -a. With Compose, container_name can differ from the service name. |
| docker compose logs web cannot find the service | The argument it expects is a service name from the compose file, not a container name. | Use the service name exactly as in the compose file, or run docker compose logs with no argument. |
| Old logs vanish after a few days | max-size and max-file rotation deletes the oldest file. | Raise max-file or max-size if you need a longer history. Logs that must last belong somewhere built for that. |
| You edited daemon.json but old containers still do not rotate | A new default only applies to containers created after Docker restarts. Or max-file was set without max-size. | Re-create the container, set max-size and max-file together, then verify with docker inspect. |

## Checklist before you close the terminal

I know the right container or service name from docker ps -a.

I always use --tail or --since so the output does not flood.

I read the first error in an attempt, not the last line.

I did not delete a crashing container before reading its log.

max-size and max-file are set together, and the container was re-created.

## Go deeper

This guide focuses on the commands. To understand why logs are stored this way, how json-file differs from journald, and how to read a failed deploy log, take the lesson

. If you want to read server logs without logging in over SSH first, see

.

The habit that covers almost every problem: find the name with docker ps -a, read with --tail, narrow with --since, and cap the log size before the disk fills. The rest is reading calmly from the first error.

## Sources and official documentation

- Docker Docs: docker container logs
- Docker Docs: docker compose logs
- Docker Docs: Configure logging drivers
- Docker Docs: JSON File logging driver
- Docker Docs: Start containers automatically (restart policies)

## Source links

- https://docs.docker.com/reference/cli/docker/container/logs/
- https://docs.docker.com/reference/cli/docker/compose/logs/
- https://docs.docker.com/engine/logging/configure/
- https://docs.docker.com/engine/logging/drivers/json-file/
- https://docs.docker.com/engine/containers/start-containers-automatically/

## FAQ

### How do I view docker logs for a running container?

Run docker logs --tail 50 container-name to see the last 50 lines. Add -f (--follow) to keep streaming new lines, and --since 10m to show only the last ten minutes. Find the container name first with docker ps -a.

### Why is docker logs empty even though the container is running?

Docker only captures what the main process writes to standard output and standard error. If the app writes to its own log file inside the container, docker logs has nothing to show. Point the app at stdout and stderr, or link the log file to them.

### Can I read the logs of a container that crashed or stopped?

Yes, as long as the container still exists. Find it with docker ps -a, which also lists stopped containers, then run docker logs --tail 100 --timestamps on it. Do not remove the container with docker rm until you have read the log, because json-file logs are stored per container.

### What is the difference between docker logs and docker compose logs?

docker logs reads one container by name or ID. docker compose logs reads the services of a Compose project, takes service names as arguments, and with no argument prints every service with a prefix on each line. Both accept --follow, --tail, --since and --timestamps.

### Why is my docker log file taking up so much disk space?

The default json-file driver does not rotate logs unless you set max-size, and max-file only works when max-size is also set. Add a logging block with max-size 10m and max-file 3 to your compose file, then re-create the container, since existing containers keep their old options.

---

- HTML version: https://www.matthewswong.com/en/blog/cara-melihat-docker-logs-untuk-pemula/
- Bahasa Indonesia: https://www.matthewswong.com/id/blog/cara-melihat-docker-logs-untuk-pemula/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json