We use docker swarm based services to host our application stack, and occasionally the stack gets removed for reasons which are not always clear. The stack removal could have been triggered by one of our build systems, from a health check failure, or manually by an administrator on the command line.
Aside from third party software monitoring the stack, what native docker features exist to monitor how, when, and why the stack was removed?
docker events seems to be our best bet. Docker Events detail what happened (eg: exec_die) and when, with some stateful data.
Is there any other way to determine who removed the stack and how?
Client: Docker Engine - Community
API version: 1.39 (downgraded from 1.40)
Go version: go1.12.8
Git commit: 6a30dfc
Built: Thu Aug 29 05:28:55 2019
Server: Docker Engine - Community
API version: 1.39 (minimum version 1.12)
Go version: go1.10.8
Git commit: 481bc77
Built: Sat May 4 02:02:43 2019