CKAD — Container Logs

Observability in Kubernetes

When things go wrong in Kubernetes, you need to find and fix the problem fast. The first place to look is always container logs.

Kubernetes captures everything your container writes to stdout and stderr. You access these logs with kubectl logs.

Basic Log Commands

# View logs for a Pod
kubectl logs my-pod

# Follow logs in real-time
kubectl logs my-pod -f

# Show last 50 lines
kubectl logs my-pod --tail=50

# Show logs from the last 5 minutes
kubectl logs my-pod --since=5m

# Show logs from the last hour
kubectl logs my-pod --since=1h

# Show logs with timestamps
kubectl logs my-pod --timestamps

# Combine: last 100 lines with timestamps
kubectl logs my-pod --tail=100 --timestamps

Multi-Container Pod Logs

If a Pod has multiple containers, you must specify which one:

# Logs from a specific container
kubectl logs my-pod -c app
kubectl logs my-pod -c sidecar

# Logs from all containers at once
kubectl logs my-pod --all-containers=true

Previous Container Logs

If a container crashed and restarted, the current logs are from the new container. To see logs from the previous (crashed) container:

kubectl logs my-pod --previous
kubectl logs my-pod -c app --previous

Exam tip: --previous is critical for debugging CrashLoopBackOff — the current container may have empty logs because it just started, but the previous container’s logs show why it crashed.

Logs from Multiple Pods

# Logs from all Pods with a specific label
kubectl logs -l app=web

# Follow logs from all Pods in a Deployment
kubectl logs -l app=web -f --all-containers

# Logs from a Job
kubectl logs job/backup-job

---

Next: Debugging Pods