Docker中查看容器日志与进程的实用技巧分享

docker run -d --name springboot-app -p 8080:8080 my-spring-boot-app

{
  "log": "2024-06-15T08:23:41.123Z INFO  [main] c.e.d.DemoApplication : Started DemoApplication in 3.212 seconds\n",
  "stream": "stdout",
  "time": "2024-06-15T08:23:41.123456789Z"
}

// TimestampedLogger.java
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
public class TimestampedLogger {
    private static final DateTimeFormatter FORMATTER =
        DateTimeFormatter.ofPattern("uuuu-MM-dd HH:mm:ss.SSS Z");
    public static void main(String[] args) throws InterruptedException {
        for (int i = 0; i < 5; i++) {
            String now = ZonedDateTime.now().format(FORMATTER);
            System.out.printf("[%s] INFO  App: heartbeat #%d%n", now, i);
            Thread.sleep(2000);
        }
        System.out.println("App exiting gracefully.");
    }
}

# Dockerfile
FROM openjdk:17-jre-slim
COPY TimestampedLogger.jar /app.jar
ENTRYPOINT ["java", "-jar", "/app.jar"]

docker build -t timestamp-logger .
docker run -d --name ts-logger timestamp-logger

docker logs --since "2024-06-15T08:20:00Z" --until "2024-06-15T08:25:00Z" ts-logger

docker logs \
  --since "2024-06-15T08:46:25Z" \
  --until "2024-06-15T08:47:25Z" \
  --timestamps \
  --no-trunc \
  my-spring-app

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <!-- 定义 JSON 格式化器，提升 ELK 可解析性 -->
    <appender name="CONSOLE_JSON" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
    </appender>
    <!-- 纯文本控制台（开发/调试用） -->
    <appender name="CONSOLE_PLAIN" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>
    <!-- 生产环境默认使用 JSON -->
    <root level="INFO">
        <appender-ref ref="CONSOLE_JSON"/>
    </root>
    <!-- 开发 profile 使用纯文本，便于 human-readable -->
    <springProfile name="dev">
        <root level="DEBUG">
            <appender-ref ref="CONSOLE_PLAIN"/>
        </root>
    </springProfile>
</configuration>

<!-- 错误示范！日志写入文件，docker logs 看不到 -->
<appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
    <file>/var/log/myapp/app.log</file>
    ...
</appender>

// StderrTest.java
public class StderrTest {
    public static void main(String[] args) {
        System.out.println("This goes to stdout → visible in docker logs");
        System.err.println("This goes to stderr → ALSO visible in docker logs!");
        try {
            throw new RuntimeException("Simulated error with stack trace");
        } catch (RuntimeException e) {
            e.printStackTrace(); // Writes to System.err → multi-line, preserved!
        }
    }
}

docker logs --no-trunc --timestamps stderr-test

$ docker top springboot-app
UID                 PID                 PPID                C                   STIME               TTY                 TIME                CMD
1001                12345               12320               0                   08:45               ?                   00:00:01            java -jar /app.jar
1001                12378               12345               0                   08:45               ?                   00:00:00            java -jar /app.jar

# 1. 获取 JVM 主进程 PID（通常是 docker top 第二列第一个数字）
# 2. 执行 jstack（需容器内安装 jdk，或使用 jre + jdk-tools 镜像）
docker exec -it springboot-app jstack 1

# Multi-stage 构建：最小化运行时体积
FROM openjdk:17-jre-slim
# 复制 JDK 工具（jstack, jstat, jmap）到运行时镜像
RUN apt-get update && apt-get install -y procps && rm -rf /var/lib/apt/lists/*

# 或使用更轻量的方案（不安装 procps，仅复制必要工具）
# FROM openjdk:17-jdk-slim  # 包含所有工具，但体积大 30MB+

// CpuIntensiveAndDeadlock.java
public class CpuIntensiveAndDeadlock {
    private static final Object lockA = new Object();
    private static final Object lockB = new Object();
    public static void main(String[] args) {
        // CPU 密集型任务（空循环）
        new Thread(() -> {
            while (true) { /* burn CPU */ }
        }, "cpu-burner").start();
        // 死锁线程 A
        new Thread(() -> {
            synchronized (lockA) {
                try { Thread.sleep(100); } catch (InterruptedException e) {}
                synchronized (lockB) { /* unreachable */ }
            }
        }, "deadlock-A").start();
        // 死锁线程 B
        new Thread(() -> {
            synchronized (lockB) {
                try { Thread.sleep(100); } catch (InterruptedException e) {}
                synchronized (lockA) { /* unreachable */ }
            }
        }, "deadlock-B").start();
        System.out.println("CPU burner & deadlock threads started. Check docker top & jstack.");
    }
}

docker build -t cpu-deadlock .
docker run -d --name cpu-demo cpu-deadlock

# 观察 CPU 使用率飙升
docker top cpu-demo

# 进入容器，用 jstack 抓取线程
docker exec cpu-demo jstack 1

# 或使用 jcmd（更现代，无需 PID）
docker exec cpu-demo jcmd 1 VM.native_memory summary

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "labels": "environment,service",
    "env": "os,version"
  }
}

sudo systemctl restart docker

docker info | grep "Logging Driver"
# 输出：Logging Driver: json-file
docker inspect cpu-demo | grep -A 5 LogConfig

docker run -d \
  --log-driver=syslog \
  --log-opt syslog-address=tcp://syslog.example.com:5140 \
  --log-opt syslog-tls-cert=/certs/client.crt \
  --log-opt syslog-tls-key=/certs/client.key \
  --log-opt syslog-tls-ca-cert=/certs/ca.crt \
  --log-opt tag="{{.Name}}/{{.ImageName}}" \
  --name sys-logger \
  timestamp-logger

{
  "log-driver": "journald",
  "log-opts": {
    "tag": "{{.Name}}/{{.ImageName}}"
  }
}

# 查看所有容器日志
journalctl -t docker

# 查看特定容器（通过 tag）
journalctl _SYSTEMD_UNIT=docker.service SYSLOG_IDENTIFIER=my-spring-app

# 实时跟踪（类似 -f）
journalctl -t docker -f

services:
  gateway:
    image: spring-cloud-gateway:3.1
    ports: ["8080:8080"]
  auth-service:
    image: auth-service:1.2
    environment:
      - SPRING_PROFILES_ACTIVE=prod
  user-service:
    image: user-service:2.0

docker compose logs --timestamps --since="5m" gateway auth-service user-service

docker compose logs --since="5m" gateway | grep "504\|timeout"
# 输出：gateway-1  | 2024-06-15T09:12:33.456Z ERROR [reactor-http-nio-4] o.s.c.g.f.WeightCalculatorWebFilter : Unable to calculate weights, returning default

docker compose logs --since="5m" auth-service | grep -E "(200|500|slow)|duration"
# 输出：auth-service-1 | 2024-06-15T09:12:33.450Z INFO  [http-nio-8081-exec-7] c.a.c.LoginController : Login success, duration=12500ms

<!-- logback-spring.xml -->
<configuration>
    <turboFilter class="ch.qos.logback.classic.turbo.DynamicThresholdFilter">
        <Key>sampleRate</Key>
        <DefaultThreshold>ALL</DefaultThreshold>
        <MDCValueLevelPair>
            <value>10</value>
            <level>INFO</level>
        </MDCValueLevelPair>
    </turboFilter>
    <!-- 或更简单的：按包名降低级别 -->
    <logger name="org.springframework.web" level="WARN"/>
    <logger name="com.fasterxml.jackson" level="WARN"/>
</configuration>

# 只看 ERROR 及以上，排除健康检查日志
docker logs my-app 2>&1 | grep -E "(ERROR|WARN|Exception|Caused by)" | grep -v "actuator/health"

# 实时监控 GC 日志（需 JVM 启用 -Xlog:gc*）
docker logs my-app | grep "GC\|gc\|G1"

# 统计最近 1000 行中各状态码出现次数（Nginx/Java Web）
docker logs my-app | tail -1000 | awk '{print $9}' | sort | uniq -c | sort -nr

# 查找过去 1 小时内所有 5xx 错误
{job="my-spring-app"} |= "50" |~ "5\\d\\d"

# 按 endpoint 分组统计延迟 P95
rate({job="my-spring-app"} |= "latency" | json | __error__ = "" [1h]) by (endpoint)

# 关联 gateway 与 auth-service 的同一 request_id
{job="gateway"} |~ "abc123" | logfmt
{job="auth-service"} |~ "abc123" | logfmt

#!/bin/bash
# docker-diagnose.sh - Run comprehensive container health check
CONTAINER_NAME=${1:-"my-app"}
echo "🔍 Diagnosing container: $CONTAINER_NAME"
echo "====================================="
echo -e "\n📋 1. Container status & uptime"
docker ps -f name=$CONTAINER_NAME --format "table {{.Names}}\t{{.Status}}\t{{.RunningFor}}"
echo -e "\n📋 2. Last 50 lines with timestamps"
docker logs --tail 50 --timestamps $CONTAINER_NAME 2>/dev/null | head -50
echo -e "\n📋 3. Top processes (PID, CPU%, CMD)"
docker top $CONTAINER_NAME | head -10
echo -e "\n📋 4. JVM memory usage (if Java)"
if docker exec $CONTAINER_NAME sh -c "which jstat >/dev/null 2>&1"; then
  docker exec $CONTAINER_NAME jstat -gc $(pgrep java) 2>/dev/null || echo "jstat not available"
else
  echo "jstat not found in container"
fi
echo -e "\n📋 5. Disk usage of Docker logs (json-file driver)"
sudo du -sh /var/lib/docker/containers/*/$CONTAINER_NAME*-json.log 2>/dev/null | sort -hr | head -5
echo -e "\n✅ Diagnosis complete. For deep dive, run:"
echo "   docker exec $CONTAINER_NAME jstack 1"
echo "   docker logs --since '10m' --no-trunc $CONTAINER_NAME | grep -i error"

chmod +x docker-diagnose.sh
./docker-diagnose.sh my-spring-app