How do I access Windows eventlog of a Docker container

Question

How do I access the Windows Event Log of a Microsoft Docker container from the host?

I have a docker container under Windows Server 2016.

The container is based on image: microsoft/iis

I can get the ip address of the container with:

docker inspect -f "{{ .NetworkSettings.Networks.nat.IPAddress }}" my-running-site

How can I connect to it via the Event Viewer on the windows host?

Answer 1

On PWSH (Powershell Core):

Get-WinEvent -LogName Application

Answer 2

Create a powershell session for the container

docker exec -it  <container_id> powershell

Then from the container, get the latest event logs

Get-Eventlog -newest 20 application

Above command will help you to find the index,

(Get-Eventlog -index xxx application).message

Answer 3

you can use evtail.exe to tail the Windows Event Log inside a Docker Windows Container. It doesn't require Powershell, so even works on Nano Server (which doesn't include Powershell).

Answer 4

The Docker Engine logs to the Windows 'Application' event log, rather than to a file. These logs can easily be read, sorted, and filtered using Windows PowerShell

For example, this will show the Docker Engine logs from the last 5 minutes starting with the oldest.

Get-EventLog -LogName Application -Source Docker -After (Get-Date).AddMinutes(-5) | Sort-Object Time