diff --git a/containers/container.go b/containers/container.go
index 4ae85b2..379d350 100644
--- a/containers/container.go
+++ b/containers/container.go
@@ -543,7 +543,8 @@ func (c *Container) onFileOpen(pid uint32, fd uint64, mnt uint64, log bool) {
 			return
 		}
 	}
-	mntId, logPath := resolveFd(pid, fd)
+	info := proc.GetFdInfo(pid, fd)
+	mntId, logPath := resolveFd(info)
 	func() {
 		if mntId == "" {
 			return
@@ -567,7 +568,14 @@ func (c *Container) onFileOpen(pid uint32, fd uint64, mnt uint64, log bool) {
 			c.lock.Unlock()
 		}
 	}()
-	if logPath != "" {
+	var logPaths []string
+	switch {
+	case logPath != "":
+		logPaths = []string{logPath}
+	case log && (info == nil || !strings.HasPrefix(info.Dest, "/var/log/")):
+		logPaths = findLogFiles(pid)
+	}
+	for _, logPath := range logPaths {
 		c.lock.Lock()
 		c.runLogParser(logPath)
 		c.lock.Unlock()
@@ -1493,8 +1501,7 @@ func (c *Container) attachTlsUprobes(tracer *ebpftracer.Tracer, pid uint32, canB
 	return true
 }
 
-func resolveFd(pid uint32, fd uint64) (mntId string, logPath string) {
-	info := proc.GetFdInfo(pid, fd)
+func resolveFd(info *proc.FdInfo) (mntId string, logPath string) {
 	if info == nil {
 		return
 	}
@@ -1518,3 +1525,20 @@ func resolveFd(pid uint32, fd uint64) (mntId string, logPath string) {
 	}
 	return
 }
+
+func findLogFiles(pid uint32) []string {
+	fds, err := proc.ReadFds(pid)
+	if err != nil {
+		return nil
+	}
+	var res []string
+	for _, fd := range fds {
+		if !strings.HasPrefix(fd.Dest, "/var/log/") {
+			continue
+		}
+		if _, logPath := resolveFd(proc.GetFdInfo(pid, fd.Fd)); logPath != "" {
+			res = append(res, logPath)
+		}
+	}
+	return res
+}
diff --git a/go.mod b/go.mod
index f47e7c1..03d0bc4 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/containerd/cgroups v1.1.0
 	github.com/containerd/containerd v1.7.29
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/coroot/logparser v1.4.0
+	github.com/coroot/logparser v1.4.2
 	github.com/florianl/go-conntrack v0.3.0
 	github.com/go-kit/log v0.2.1
 	github.com/gobwas/glob v0.2.3
diff --git a/go.sum b/go.sum
index 782fcc4..c1c51e9 100644
--- a/go.sum
+++ b/go.sum
@@ -92,8 +92,8 @@ github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/coroot/dotnetdiag v1.2.2 h1:PVP/By8o+xhPjfVolJYcjHLbFQInM7pkaD6/otPLc8Q=
 github.com/coroot/dotnetdiag v1.2.2/go.mod h1:veXCMlFzm1yNl7wwJb/ZLxO4WbzhDBoy1VG1XtkH2ls=
-github.com/coroot/logparser v1.4.0 h1:/b+XnAh7kuKR1mVSekPCSPpKloWx6wJveHa0HDcXueY=
-github.com/coroot/logparser v1.4.0/go.mod h1:5mgr/LIFAEuhxLgnFTtEXVWKthT1l2ZTsPHF6oOGc/E=
+github.com/coroot/logparser v1.4.2 h1:0UxS7R2jLGc0l4seLkA42IKDGivwLFBPC7yzqc9LQv8=
+github.com/coroot/logparser v1.4.2/go.mod h1:5mgr/LIFAEuhxLgnFTtEXVWKthT1l2ZTsPHF6oOGc/E=
 github.com/coroot/pyroscope/ebpf v0.0.0-20260804213318-758a0e72af3a h1:whKF1ZhIGcaAn9ZV5hbBSkrw7C5OBgWasZ0bYktOW+U=
 github.com/coroot/pyroscope/ebpf v0.0.0-20260804213318-758a0e72af3a/go.mod h1:IepHM9FJ0n3n3k+ZV23Y7vNAfvWI7LDuLqWPO4rB6sQ=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=