Using Docker's ETW log driver in Windows

In Docker’s ETW logging driver doc, it uses the tool logman to view the logs. In this article, I will show you how to use mftrace to view Docker ETW logs in real-time.

First, here’s a simple application written in Go that logs to STDERR every second.

Next, let’s create a Docker image (Windows) using the Dockerfile below.

# assuming the code above is saved in a directory called 'demoapp'
$ docker build -t demoapp .

To use mftrace, we need a config file.

Open a command prompt (or Powershell) and run the following command.

$ mftrace.exe -c config.xml

Then open another command prompt (or Powershell) window and run the Docker image.

$ docker run -d --log-driver=etwlogs --name demoapp demoapp:latest

You should be able to view the application logs in the mftrace window.

You can use this repo instead of creating your own folder structure. Instructions are provided in the README as well as an x86 version of mftrace.

This work is licensed under a Creative Commons Attribution 4.0 International License.