How to check the logs of running and crashed pods in Kubernetes?

Question

If you have managed any kind of Linux bases servers, you have probably used commands like cat and tail to check your server logs.

Here I will show you how to check the logs of your Kubernetes pods for both running and crashed pods using the kubectl command.

Bobby · Accepted Answer

Before you get started, you need to have the following things:

Getting the name of your pod

First, you need to get your pod’s name. To do so, you could run the following command:

kubectl get pods

If you want to get the pods from a specific namespace, you need to use the following:

kubectl --namespace='your-namespace' get pods

This will return a list of all of your pods, and you need to note down the name of the pods that you want to check the logs for:

NAME                              READY     STATUS             RESTARTS   AGE
nginx-7d8b49557c-c2lx9            1/1       Running            5          1d
nodejs-59f6cdb678-pkn2g           1/1       Running            0          1d
php-fpm-7dcb9c8dd6-r5jbj          1/1       Running            0          1d

With that, you are ready to check your logs!

Checking the logs of a running pod

Let’s say that we wanted to check the logs of the Nginx pod with the name nginx-7d8b49557c-c2lx9 as there have been 5 restarts. All that you need to do to do that is to run the following command:

kubectl logs nginx-7d8b49557c-c2lx9

Note: you might have to specify your namespace in case that you have one

kubectl --namespace logs nginx-7d8b49557c-c2lx9

This will show you all of the available logs for this specific pod.

Check the logs and tail them in real-time

Just like with the tail command, you can just use the -f flag to stream the logs in real-time.

To do so, you need to add the -f flag to the above commands:

kubectl logs -f nginx-7d8b49557c-c2lx9

This will open a stream of your logs, and you will see the logs on your screen in real-time as they populate.

To stop that, just press CTRL+C.

Checking the logs of a crashed pod

In case that a pod restarts, and you wanted to check the logs of the previous run, what you need to do is to use the --previous flag:

kubectl logs nginx-7d8b49557c-c2lx9 --previous

This will show you the logs of the last run of the pod before it crashed. It is a handy feature in case you want to figure out why the pod crashed in the first place.

Checking the logs of a specific container inside a pod

In some cases, you might have multiple containers running inside a single pod. Of course, it is better to keep things isolated and not stack up multiple containers in a single pod, but there are cases where you need to do that.

In case that there are 2 containers, you would see something like this when running kubectl get pods:

NAME                              READY       STATUS             RESTARTS   AGE
nginx-7d8b49557c-c2lx9            2/2        Running            5          1d

In this case, if you just run kubectl logs nginx-7d8b49557c-c2lx9, it will not work as Kubernetes will not know which container you want to check the logs for. You will see the following error:

error: a container name must be specified for pod nginx-7d8b49557c-c2lx9, 
choose one of: [nginx fpm]

As we can see from the output, Kubernetes wants us to specify one of the two containers we want to check the logs for: nginx or the fpm container.

To do that we just need to use the -c argument:

kubectl logs nginx-7d8b49557c-c2lx9 -c nginx

You can add the other arguments like --previous and --namespace to this command as well.

Conclusion

This is pretty much it! Now you know how to check the logs of your Kubernetes pods! This will enormously help you with any troubleshooting that you need to do.

I hope that this helps!