Kubernetes Logs and Events Cheat Sheet

kubectl logs <pod> -n <namespace>

# Print logs from the default container in a pod.

kubectl logs <pod> -n <namespace> -c <container>

# Required for sidecars and multi-container pods.

kubectl logs -f <pod> -n <namespace> --timestamps

# Stream logs with timestamps for incident reconstruction.

kubectl logs <pod> -n <namespace> --tail=200

# Limit output while checking current behavior.

kubectl logs <pod> -n <namespace> --since=30m

# Filter to a recent time window during an incident.

kubectl logs <pod> -n <namespace> --previous

# Useful for restarts and CrashLoopBackOff.

kubectl logs deployment/<name> -n <namespace>

# Print logs from a workload resource instead of a single pod.

kubectl logs job/<name> -n <namespace>

# Fetch logs for batch workloads using the Job resource.

kubectl logs -n <namespace> -l app=<label> --all-containers=true --prefix

# Aggregate logs across all containers of pods with a label.

kubectl logs -n <namespace> -l app=<label> -f --all-containers=true --max-log-requests=20

# Useful during rollouts or multi-pod incidents.

kubectl get events -n <namespace>

# See the recent warning and normal events in a namespace.

kubectl get events -n <namespace> --sort-by=.metadata.creationTimestamp

# Create an incident timeline from namespace events.

kubectl get events -A --sort-by=.metadata.creationTimestamp

# Find cluster-wide warnings around the same time window.

kubectl get events -A --field-selector type=Warning --sort-by=.metadata.creationTimestamp

# Filter event list down to warning-level entries.

kubectl describe pod <pod> -n <namespace> | sed -n '/Events:/,$p'

# Describe an object and inspect its event section.

kubectl logs -n kube-system -l k8s-app=<label> --all-containers=true --prefix

# Aggregate logs from a system component by label.

kubectl get pods -n kube-system -o wide | egrep 'apiserver|scheduler|controller-manager|etcd'

# Check apiserver, scheduler, controller-manager, and etcd pods.

kubectl logs -n kube-system <kube-apiserver-pod>

# Inspect API server errors and admission failures.

kubectl logs -n kube-system <kube-controller-manager-pod>

# Troubleshoot controllers and reconciliation failures.

kubectl logs -n kube-system <kube-scheduler-pod>

# Inspect placement and scheduling behavior.

kubectl get <resource> <name> -n <namespace> -o yaml > incident-object.yaml

# Capture the exact spec and status for later analysis.

kubectl cluster-info dump --output-directory=./cluster-dump

# Collect cluster state to files instead of stdout.

kubectl logs <pod> -n <namespace> --all-containers=true > pod.log

# Persist logs for investigation or attachment to a ticket.