--- name: retrieving-k8s-logs description: Retrieves Kubernetes container logs with various patterns including multi-container pods, previous container logs, init containers, and label-based aggregation. Use when checking application logs, debugging crashes, or analyzing container output. allowed-tools: Bash --- # Retrieving Kubernetes Logs Patterns for retrieving container logs effectively. ## Basic Log Commands ```bash # Current container logs kubectl logs -n # Last N lines kubectl logs -n --tail=100 # Logs since time kubectl logs -n --since=1h kubectl logs -n --since=30m # With timestamps kubectl logs -n --timestamps ``` ## Multi-Container Pods ```bash # List containers in pod kubectl get pod -n -o jsonpath='{.spec.containers[*].name}' # Logs from specific container kubectl logs -n -c # Logs from all containers kubectl logs -n --all-containers ``` ## Previous Container (After Crash) ```bash # Logs from previous container instance (after restart\/crash) kubectl logs -n --previous # Previous logs from specific container kubectl logs -n -c --previous ``` Use `--previous` when: - Pod is in CrashLoopBackOff - Container restarted and you need pre-crash logs - Current container logs don't show the error ## Init Container Logs ```bash # List init containers kubectl get pod -n -o jsonpath='{.spec.initContainers[*].name}' # Get init container logs kubectl logs -n -c ``` ## Label-Based Log Aggregation ```bash # Logs from all pods with label kubectl logs -l app= -n # With tail limit per pod kubectl logs -l app= -n --tail=50 # All containers in labeled pods kubectl logs -l app= -n --all-containers ``` ## Searching Logs ```bash # Grep for pattern kubectl logs -n | grep -i error # Grep with context kubectl logs -n | grep -i -A5 -B5 "exception" # Count occurrences kubectl logs -n | grep -c "error" ``` ## Log Patterns for Debugging ### Application Crash ```bash # Get last 200 lines before crash kubectl logs -n --previous --tail=200 # Look for error\/exception kubectl logs -n --previous | grep -i -E "error|exception|fatal|panic" ``` ### Startup Issues ```bash # First 100 lines (startup) kubectl logs -n | head -100 # Check init containers first kubectl logs -n -c ``` ### Intermittent Issues ```bash # Logs from last 2 hours with timestamps kubectl logs -n --since=2h --timestamps # Tail and follow (for live debugging) # Note: This blocks, use Ctrl+C to stop kubectl logs -n -f --tail=50 ``` ### Memory Issues (OOM) ```bash # Check for memory-related messages before OOM kubectl logs -n --previous | grep -i -E "memory|heap|oom|gc" ``` ## Log Output Formats ```bash # Raw logs (default) kubectl logs -n # With pod name prefix (useful for multi-pod) kubectl logs -l app= -n --prefix # Limit bytes (for huge logs) kubectl logs -n --limit-bytes=50000 ``` ## Quick Debugging Pattern ```bash # 1. Check current logs for errors kubectl logs -n --tail=100 | grep -i error # 2. If pod crashed, check previous logs kubectl logs -n --previous --tail=200 # 3. If init container failed kubectl get pod -n -o jsonpath='{.spec.initContainers[*].name}' kubectl logs -n -c # 4. Check all containers in pod kubectl logs -n --all-containers --tail=50 ``` ## Notes - `--previous` only works if container restarted (keeps one previous log) - Logs are ephemeral; they're lost when pod is deleted - For persistent logs, use a logging stack (EFK, Loki, etc.) - Load `debugging-k8s-pods` for container state analysis