How do I access Windows eventlog of a Docker container How do I access Windows eventlog of a Docker container docker docker

How do I access Windows eventlog of a Docker container


Create a powershell session for the container

docker exec -it  <container_id> powershell

Then from the container, get the latest event logs

Get-Eventlog -newest 20 application

Above command will help you to find the index,

(Get-Eventlog -index xxx application).message


The Docker Engine logs to the Windows 'Application' event log, rather than to a file. These logs can easily be read, sorted, and filtered using Windows PowerShell

For example, this will show the Docker Engine logs from the last 5 minutes starting with the oldest.

Get-EventLog -LogName Application -Source Docker -After (Get-Date).AddMinutes(-5) | Sort-Object Time 


On PWSH (Powershell Core):

Get-WinEvent -LogName Application