7

We have CentOS based infra for kubernetes and also using Openshift on top of tis. We have terminated a pod and now its not visible on master controller any more. However we are willing to analyze its logs.Can we still access its logs?How ?

knowdotnet
  • 839
  • 1
  • 15
  • 29

3 Answers3

7

Containers together with its logs get deleted when you issue a kubectl delete pod <pod-name>. You can use something like Fluentd or logspout to pipe your logs to say an ELK or an EFK stack.

Rico
  • 58,485
  • 12
  • 111
  • 141
  • 2
    How do you know FluentD processed all logs before the files were deleted? – Martín Coll Apr 07 '20 at 19:47
  • They are usually streamed real time and assuming you don't have network/capacity issues, they would make it to its final destination. So whatever you delete, should be already in something like elastic search. – Rico Apr 08 '20 at 05:45
  • Thanks! I'll see what I can do to ensure I get no network or capacity issues – Martín Coll Apr 08 '20 at 16:24
0

Looks like the container is removed (docker rm) once the kubectl delete of the pod is done and the log files are gone. One way I can think of is using fluentd or something similar for log aggregation.

Praveen Sripati
  • 32,799
  • 16
  • 80
  • 117
0

If you have access to the Kubernetes Dashboard, you can access logs for deleted/completed pods in the desired namespace.

  • 1
    `kubectl get events | grep pod-name` just in case Dashboard is not there or when there is no access to Dashboard. But, not sure how long the events are retained. So, it's always better to use a log aggregator. – Praveen Sripati Oct 01 '18 at 01:22
  • 1
    Also, in the Dashboard those are events and not logs in the namespace. The application logs are not visible there. The OP was about logs and not events. – Praveen Sripati Oct 01 '18 at 01:58
  • we are using prometheus and DataDog to collect logs data – knowdotnet Oct 02 '18 at 06:25