In Docker’s ETW logging driver doc, it uses the tool logman to view the logs. In this article, I will show you how to use mftrace to view Docker ETW logs in real-time.
First, here’s a simple application written in Go that logs to STDERR every second.
Next, let’s create a Docker image (Windows) using the Dockerfile below.
# assuming the code above is saved in a directory called 'demoapp'
$ docker build -t demoapp .
To use mftrace, we need a config file.
Open a command prompt (or Powershell) and run the following command.
$ mftrace.exe -c config.xml
Then open another command prompt (or Powershell) window and run the Docker image.
$ docker run -d --log-driver=etwlogs --name demoapp demoapp:latest
You should be able to view the application logs in the mftrace window.
You can use this repo instead of creating your own folder structure. Instructions are provided in the README as well as an x86 version of mftrace.