Kubernetes Logs and Events Cheat Sheet

Kubernetes Debugging•Permalink

Find pod logs, previous container logs, event timelines, kube-system logs, and cluster incident evidence quickly.

View

Standard Detailed Compact

Export

Copy the compact sheet, download it, or print it.

Download

`D` dense toggle · `C` copy all

Pod Logs

Get pod logs

Print logs from the default container in a pod.

↗#

bashANYlogspods

bash

kubectl logs <pod> -n <namespace>

Get logs from a named container

Required for sidecars and multi-container pods.

↗#

bashANYlogscontainers

bash

kubectl logs <pod> -n <namespace> -c <container>

Follow logs with timestamps

Stream logs with timestamps for incident reconstruction.

↗#

bashANYlogstimestamps

bash

kubectl logs -f <pod> -n <namespace> --timestamps

Tail recent log lines

Limit output while checking current behavior.

↗#

bashANYlogstail

bash

kubectl logs <pod> -n <namespace> --tail=200

Read recent logs only

Filter to a recent time window during an incident.

↗#

bashANYlogstime-range

bash

kubectl logs <pod> -n <namespace> --since=30m

Read previous logs after a restart

Useful for restarts and CrashLoopBackOff.

↗#

bashANYlogsprevious

bash

kubectl logs <pod> -n <namespace> --previous

Aggregate Logs by Workload

Read logs via deployment resource

Print logs from a workload resource instead of a single pod.

↗#

bashANYlogsdeployment

bash

kubectl logs deployment/<name> -n <namespace>

Read logs via Job resource

Fetch logs for batch workloads using the Job resource.

↗#

bashANYlogsjobs

bash

kubectl logs job/<name> -n <namespace>

Read logs from pods matching a label

Aggregate logs across all containers of pods with a label.

↗#

bashANYlogslabels

bash

kubectl logs -n <namespace> -l app=<label> --all-containers=true --prefix

Follow logs for matching pods

Useful during rollouts or multi-pod incidents.

↗#

bashANYlogsstreaming

bash

kubectl logs -n <namespace> -l app=<label> -f --all-containers=true --max-log-requests=20

Event Analysis

List namespace events

See the recent warning and normal events in a namespace.

↗#

bashANYeventsnamespace

bash

kubectl get events -n <namespace>

Sort events by timestamp

Create an incident timeline from namespace events.

↗#

bashANYeventstimeline

bash

kubectl get events -n <namespace> --sort-by=.metadata.creationTimestamp

Sort all cluster events by timestamp

Find cluster-wide warnings around the same time window.

↗#

bashANYeventscluster

bash

kubectl get events -A --sort-by=.metadata.creationTimestamp

Show warning events only

Filter event list down to warning-level entries.

↗#

bashANYeventswarnings

bash

kubectl get events -A --field-selector type=Warning --sort-by=.metadata.creationTimestamp

Show events for a specific object

Describe an object and inspect its event section.

↗#

bashANYeventsdescribe

bash

kubectl describe pod <pod> -n <namespace> | sed -n '/Events:/,$p'

System and Control Plane Logs

Read logs from kube-system pods

Aggregate logs from a system component by label.

↗#

bashANYkube-systemlogs

bash

kubectl logs -n kube-system -l k8s-app=<label> --all-containers=true --prefix

List control plane static pods

Check apiserver, scheduler, controller-manager, and etcd pods.

↗#

bashANYcontrol-planelogs

bash

kubectl get pods -n kube-system -o wide | egrep 'apiserver|scheduler|controller-manager|etcd'

Read kube-apiserver logs

Inspect API server errors and admission failures.

↗#

bashANYapiserverlogs

bash

kubectl logs -n kube-system <kube-apiserver-pod>

Read controller-manager logs

Troubleshoot controllers and reconciliation failures.

↗#

bashANYcontroller-managerlogs

bash

kubectl logs -n kube-system <kube-controller-manager-pod>

Read scheduler logs

Inspect placement and scheduling behavior.

↗#

bashANYschedulerlogs

bash

kubectl logs -n kube-system <kube-scheduler-pod>

Incident Collection

Export object YAML during incident

Capture the exact spec and status for later analysis.

↗#

bashANYincidentyaml

bash

kubectl get <resource> <name> -n <namespace> -o yaml > incident-object.yaml

Dump cluster info to a directory

Collect cluster state to files instead of stdout.

↗#

bashANYincidentdiagnostics

bash

kubectl cluster-info dump --output-directory=./cluster-dump

Save pod logs to a file

Persist logs for investigation or attachment to a ticket.

↗#

bashANYincidentlogs

bash

kubectl logs <pod> -n <namespace> --all-containers=true > pod.log

More in Kubernetes Debugging

Kubernetes Node Debugging Cheat Sheet

Diagnose node readiness, kubelet issues, pressure conditions, cordon/drain, and node-level debugging with kubectl debug.

Kubernetes Network Debugging Cheat Sheet

Debug Services, DNS, Ingress, network policies, connectivity, endpoints, and port-forwarding issues.

Kubernetes Pod Debugging Cheat Sheet

Troubleshoot Pending, CrashLoopBackOff, image pull, readiness, liveness, and init container problems.

Kubernetes Debugging Cheat Sheet

Core kubectl troubleshooting commands for pods, deployments, services, events, logs, exec sessions, and ephemeral debugging.

Recommended next

No recommendations yet.

Browse all sheets →