Skip to main content

Docker Success Center

The Docker enterprise customer portal.

Docker, Inc.

What options are there to log any action executed by any user in UCP

Actions on a container such as create/start/stop/rm aren't logged by UCP, and UCP container actions are not logged with any of the default log drivers.

To log container actions such as start/stop/remove, install a more comprehensive logging utility. Many are available, but one such option is Sysdig's Falco, an activity monitor with support for Docker containers. This application has the ability to log run/stop/remove and other container behavior. It also has some powerful behavior detection capabilities as well as network logging capabilities. Sysdig's Falco is open source and requires the installation of a kernel module on each node to be monitored.