can only see the prod aks log in ContainerLog

Question

can only see the prod aks log in ContainerLog

but last week , i can see all the aks envs including dev,qa,prod; but this week, i can only query log about prod aks in ContainerLog;

the KQL is :

ContainerLog
| where TimeGenerated >= ago(90d)
| summarize LinesOfLogsFromNode = count() by Computer

Answer 1

Hi Zhong, Shui Jin (Azure Account)

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

It sounds like the issue might be related to changes in the data collection settings or configurations for your Azure Kubernetes Service (AKS) clusters. Here are a few steps to troubleshoot and resolve this issue:

Ensure that the data collection rules for your AKS clusters haven’t been modified. Changes in DCR can affect which logs are collected and sent to the ContainerLog table.

If you are using ConfigMap for data collection settings, verify that the settings haven’t been altered. The ConfigMap settings can override DCR settings.

Ensure that the Log Analytics workspace is correctly configured to collect logs from all your AKS environments (dev, qa, prod). Sometimes, workspace settings might be inadvertently changed.

Verify the status of the monitoring agents on your AKS clusters. You can use the following command to check the status:

kubectl get ds ama-logs --namespace=kube-system

Ensure that the necessary permissions are in place for the Log Analytics workspace and the AKS clusters.

For more detailed information and troubleshooting steps, please refer to the below document:
Troubleshoot Container insights
Query logs from Container insights

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".