Back to lessons

Web Server Rescue

Read Recent Container Logs

A container is failing and full logs are too large or too noisy.

Command

docker logs --since 10m --tail 100 api

What changed

Nothing changes locally. Docker reads recent log output for one container.

Danger

caution

When to use it

Use when checking recent crashes, startup errors, HTTP failures, or deployment regressions.

When not to use it

Do not paste raw logs into public channels without reviewing them for secrets or user data.

Undo or recovery

No undo needed because this command is read-only.

Expected output

The last 100 log lines from the previous 10 minutes.

demo script

Disposable terminal steps

  1. docker logs --since 10m --tail 100 api
  2. docker logs --since 30m --tail 200 api 2>&1 | grep -i 'error\|fail\|exception'

simulated output

What it looks like

disposable vessel
::fixture-ready::
$ docker logs --since 10m --tail 100 api
2026-06-25T14:18:01Z INFO booting api
2026-06-25T14:18:03Z ERROR database connection refused
2026-06-25T14:18:05Z INFO retrying startup
::exit-code::0
$ docker logs --since 30m --tail 200 api 2>&1 | grep -i 'error\|fail\|exception'
2026-06-25T14:18:03Z ERROR database connection refused
2026-06-25T14:18:05Z fatal startup failed
::exit-code::0

YouTube Short

Docker logs without the flood.

For triage, do not start with every log line ever written. Use since and tail together.

LinkedIn hook

Skip the million-line log scroll and read only the recent failure window.

Question: What time window do you usually start with when reading container logs?

experiments

A/B tests to run

Metric: average_view_duration

A: Skip the million-line log scroll.

B: Start with the last 10 minutes of logs.