How to collect windows event logs(System event log, Application event log) from AKS pods?

Question

To debug a deployment pod, we would require windows system event log and application event logs from that particular pod.

Is it possible to collect the above mentioned logs rather than using 'kubectl log' command?

Answer 1

Hi @Sreejith P S

Thank you for posting in Q & A.

The command kubectl get events -n <namespace> returns all events within a specific namespace

Using kubectl describe pod <pod-name> provides a lot of useful information about the pod, including a section listing the latest events:

kubectl log only collects the data from STDOUT & STDERR. As long as your application does not send logs to STDOUT & STDERR, you will be not able to see those with kubectl logs.
As a temp workaround you can use kubectl exec to locate your logfiles and then kubectl cp to copy those to your local pc.
Refer

Container insights includes the Live Data feature, which is an advanced diagnostic feature allowing you direct access to your Azure Kubernetes Service (AKS) container logs (stdout/stderror), events, and pod metrics.
How to view Kubernetes logs, events, and pod metrics in real-time

Built-in to the Azure portal is the ability to view logs for the AKS master components or containers in an AKS cluster. Occasionally, you may need to get kubelet logs from an AKS node for troubleshooting purposes.
Get kubelet logs from Azure Kubernetes Service (AKS) cluster nodes

Using Azure Monitor Logs with Azure Kubernetes Service (AKS)

If the Answer is helpful, please click Accept Answer and up-vote, so that it can help others in the community looking for help on similar topics.