Podman logging: viewing, retention, and collection

Use podman logs -f --tail 100 --since 10m web to follow recent output from a container named web. Podman captures stdout/stderr through the selected logging driver; it does not automatically read files inside the container. For longer-term investigation, check the actual driver, its retention policy, and how those records reach central storage.

Read recent output

podman logs web
podman logs -f web
podman logs --tail 50 web
podman logs --since 30m web
podman logs --timestamps web

--tail limits the number of lines, --since selects a time window, and --timestamps includes the record timestamp. Combine them to avoid loading a large backlog before following new records. Stop following with Ctrl-C; this ends the log-reading command, not the container.

These commands read what the configured driver retained. They cannot reconstruct records already removed by retention or capture messages the application wrote only to a file. Removing a container while following its logs can also prevent the final messages from being read; export needed evidence before removal.

Check the logging driver

podman info --format '{{ .Host.LogDriver }}'

The current Podman documentation lists journald as the default, but packaging and local configuration can change it. Confirm the environment instead of assuming that every machine uses the same backend.

On a Linux host using journald, a container-name field can help narrow a search:

journalctl CONTAINER_NAME=web --since '30 minutes ago'

Confirm the actual fields in the journal and that your user can read the relevant entries. Rootless and system-level services may have different visibility. With Podman on macOS or Windows, the Linux VM hosts the container runtime and its journal; querying the desktop operating system's logs is not the same operation.

Bound storage without copying Docker options

For k8s-file, Podman documents a file-size limit:

podman run --name log-demo --log-driver k8s-file \
  --log-opt max-size=10mb \
  docker.io/library/alpine:3.22 \
  sh -c 'echo "application started"; echo "diagnostic message" >&2'
podman logs log-demo

This short-lived example intentionally retains the stopped container so its logs can be inspected. Remove the demonstration container when you no longer need it.

max-size bounds the file; it does not establish an archive of a particular number of days. Do not copy Docker's max-file setting into Podman and assume the same multi-file rotation behavior. Validate the installed Podman/conmon version and collector behavior when the limit is reached.

For journald, configure storage and retention through the journal service. Persistent storage is a separate choice from using the journald driver: a journal held only under /run will not survive reboot. Check disk-use limits, persistence, permissions, and rate limiting as part of the host policy. Export records that must outlive the local journal.

Inspect multiple containers and export evidence

For a quick snapshot of running containers:

podman ps --format '{{.Names}}' |
while IFS= read -r container; do
  printf '\n== %s ==\n' "$container"
  podman logs --tail 20 "$container"
done

Use podman ps -a if stopped containers are relevant. A sequential snapshot is not a globally ordered timeline; correlate records using their timestamps and container identities.

Export both output streams when saving an investigation file:

podman logs --timestamps web > web.log 2>&1

The redirection also captures command diagnostics, so inspect the result and command exit status before treating the file as a complete export. Store sensitive records with appropriate permissions. This export is a point-in-time copy, not an ongoing collection service.

Collect centrally with the correct parser

If the application writes to a host-mounted file, DataKit file log collection can read that path with appropriate permissions and parsing. Preserve the original event time and attach stable service and container identifiers.

For k8s-file or journald, first verify a supported reading path and parser. The json-file alias does not make Podman output Docker JSON. Send a distinct test message through stdout and stderr, locate both records, and verify fields, timestamps, restart behavior, and what happens at the local storage limit. If the collection path cannot read the selected driver, change the integration deliberately rather than adding a misleading parser.

Frequently asked questions

Why does podman logs show nothing?

Check whether the application writes to standard streams, whether the selected driver stores readable logs, whether records have expired, and whether you are inspecting the correct rootless/rootful environment or remote connection. A file inside the container is outside this logging channel.

Should I choose journald or the file driver?

Journald fits a systemd-managed host where journal access and retention are already operated. k8s-file can fit a collector that explicitly supports that format. Choose based on the whole reading and retention path; the Docker-compatible alias is not a compatibility guarantee for the collector.

How do I fix garbled non-ASCII text?

Check the bytes emitted by the application, then the terminal and collector decoding. Setting LANG=C.UTF-8 can help when the image provides that locale and the application uses it. It cannot repair bytes already encoded incorrectly or a parser reading them with the wrong encoding.

References and next steps

• Podman run: logging drivers and options
• Podman logs
• systemd journal storage settings
• podman exec (Chinese)
• podman run (Chinese)

These examples are based on official documentation checked October 14, 2026. They were not executed against a Podman installation; confirm version, permissions, and retention behavior on a test host before applying them to production.