kubectl logs for debugging in Kubernetes - Step-by-Step Execution

Process Flow - kubectl logs for debugging

Start: Identify Pod

↓

Run kubectl logs <pod-name>

↓

Fetch logs from Pod's container

↓

Display logs in terminal

↓

Analyze logs for errors or info

↓

Decide next step: Fix issue or get more logs

↓

Use options like -c, --since, --tail

↓

End

This flow shows how to use kubectl logs command to fetch and analyze logs from a Kubernetes pod for debugging.

Execution Sample

Kubernetes

kubectl logs my-pod
kubectl logs my-pod -c my-container
kubectl logs my-pod --since=1h
kubectl logs my-pod --tail=50

These commands fetch logs from a pod, optionally specifying container, time range, or number of lines.

Process Table

Step	Command Run	Action	Result/Output
1	kubectl logs my-pod	Fetch logs from default container in pod 'my-pod'	Logs displayed in terminal from pod's default container
2	kubectl logs my-pod -c my-container	Fetch logs from container 'my-container' in pod 'my-pod'	Logs displayed for specified container
3	kubectl logs my-pod --since=1h	Fetch logs from last 1 hour	Logs from last 1 hour shown
4	kubectl logs my-pod --tail=50	Fetch last 50 lines of logs	Only last 50 log lines displayed
5	kubectl logs unknown-pod	Try fetching logs from non-existent pod	Error: pod not found
6	kubectl logs my-pod --follow	Stream logs live	Logs stream continuously until stopped
7	Exit	No more commands	End of debugging session

💡 User stops after viewing logs or encounters error like pod not found

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
pod-name	my-pod	my-pod	my-pod	my-pod	my-pod	unknown-pod	my-pod	my-pod
container-name	default	default	my-container	my-container	default	default	default	default
logs-output	empty	logs from default container	logs from my-container	logs last 1 hour	last 50 lines logs	error: pod not found	streaming logs	streaming logs or stopped

Key Moments - 3 Insights

Why do I get an error when running kubectl logs on a pod?

If the pod name is wrong or the pod is not running, kubectl logs shows an error. See step 5 in execution_table where 'unknown-pod' causes 'pod not found' error.

How do I get logs from a specific container in a pod with multiple containers?

Use the -c option with the container name. Step 2 shows 'kubectl logs my-pod -c my-container' fetching logs from the specified container.

How can I see only recent logs or limit the amount of logs?

Use options like --since to get logs from a time range or --tail to limit lines. Steps 3 and 4 demonstrate these options.

Visual Quiz - 3 Questions

Look at the execution_table, what output do you get when running 'kubectl logs my-pod --tail=50'?

A Logs from the last 1 hour

B Error: pod not found

C Logs from the last 50 lines

D Streaming logs continuously

💡 Hint

Check step 4 in the execution_table for the command with --tail=50

At which step does the command fail due to a non-existent pod?

A Step 5

B Step 3

C Step 2

D Step 6

💡 Hint

Look for the error message 'pod not found' in the execution_table

If you want to see logs from a specific container, which command would you use?

A kubectl logs my-pod --since=1h

B kubectl logs my-pod -c my-container

C kubectl logs my-pod --tail=50

D kubectl logs unknown-pod

💡 Hint

Refer to step 2 in the execution_table where container is specified with -c

Concept Snapshot

kubectl logs <pod-name> - Fetch logs from a pod's default container
Use -c <container-name> to specify container in multi-container pods
Options --since and --tail limit logs by time or lines
--follow streams logs live for real-time debugging
Errors occur if pod name is wrong or pod is not running

Full Transcript

This visual execution shows how to use the kubectl logs command to debug Kubernetes pods. First, identify the pod name. Then run 'kubectl logs <pod-name>' to fetch logs from the default container. Use -c to specify a container if there are multiple. Options like --since and --tail help limit logs by time or number of lines. If the pod name is incorrect, an error appears. You can also stream logs live with --follow. This step-by-step trace helps beginners see how commands fetch logs and handle errors.

Practice

1. What does the kubectl logs command do in Kubernetes?

easy

A. Deletes a pod from the cluster

B. Lists all pods running in the cluster

C. Creates a new pod with specified configuration

D. Shows the output logs of a container inside a pod

Solution

1. Step 1: Understand the purpose of kubectl logs

   This command is used to view the logs generated by containers running inside pods in Kubernetes.

2. Step 2: Differentiate from other commands

   Deleting pods uses kubectl delete, creating pods uses kubectl create, and listing pods uses kubectl get pods. None of these show logs.

3. Final Answer:

   Shows the output logs of a container inside a pod -> Option D

4. Quick Check:

   Logs = Output from container [OK]

Hint: Logs show container output, not pod creation or deletion [OK]

Common Mistakes:

• Confusing logs with pod creation or deletion
• Thinking logs list pods instead of showing output
• Assuming logs show cluster-wide events

2. Which of the following is the correct syntax to follow logs live from a pod named webapp-123?

easy

A. kubectl logs webapp-123 --follow

B. kubectl logs --tail webapp-123

C. kubectl logs webapp-123 -t

D. kubectl logs -t webapp-123

Solution

1. Step 1: Recall correct flag placement

   The --follow flag comes after the pod name in the kubectl logs command syntax.

2. Step 2: Check distractor flags

   Distractors use --tail (shows last lines, no streaming) or -t (timestamps, no follow). Only --follow streams live.

3. Final Answer:

   kubectl logs webapp-123 --follow -> Option A

4. Quick Check:

   Pod name first, then flags [OK]

Hint: Put pod name before flags like --follow [OK]

Common Mistakes:

• Placing flags before pod name
• Using --tail or -t instead of --follow
• Mixing order of arguments

3. Given the command kubectl logs mypod --tail=5, what will be the output?

medium

A. Shows all logs except the last 5 lines from the pod named mypod

B. Shows the first 5 lines of logs from the pod named mypod

C. Shows the last 5 lines of logs from the pod named mypod

D. Shows logs only if the pod has more than 5 containers

Solution

1. Step 1: Understand the --tail option

   The --tail=5 option limits the output to the last 5 lines of the logs.

2. Step 2: Confirm it applies to the specified pod

   The command targets the pod named mypod, so logs shown are from that pod only.

3. Final Answer:

   Shows the last 5 lines of logs from the pod named mypod -> Option C

4. Quick Check:

   --tail = last lines [OK]

Hint: --tail shows last lines, not first [OK]

Common Mistakes:

• Thinking --tail shows first lines
• Confusing pod logs with container logs
• Assuming it filters by container count

4. You run kubectl logs mypod -c mycontainer but get an error saying container not found. What is the likely cause?

medium

A. The pod mypod is not running

B. The container name mycontainer does not exist in pod mypod

C. You forgot to add the --follow flag

D. The pod mypod has multiple containers but you did not specify one

Solution

1. Step 1: Analyze the error message

   The error says container not found, which means the container name given is incorrect or missing in the pod.

2. Step 2: Check command correctness

   You specified -c mycontainer, so if the container name is wrong, the error appears. Pod running state or missing --follow flag does not cause this error.

3. Final Answer:

   The container name mycontainer does not exist in pod mypod -> Option B

4. Quick Check:

   Container name must match exactly [OK]

Hint: Check container name spelling matches pod's containers [OK]

Common Mistakes:

• Assuming pod state causes container not found error
• Forgetting to specify container when multiple exist
• Using wrong flag for container name

5. You want to debug a pod with two containers named frontend and backend. Which command correctly streams live logs from the backend container only?

hard

A. kubectl logs podname -c backend --follow

B. kubectl logs podname --tail -c backend

C. kubectl logs -c backend podname --tail

D. kubectl logs --tail podname -c backend

Solution

1. Step 1: Recall correct argument order

   The pod name must come immediately after kubectl logs, followed by flags like -c and --follow.

2. Step 2: Confirm container and follow flag usage

   Using -c backend specifies the backend container, and --follow streams logs live.

3. Final Answer:

   kubectl logs podname -c backend --follow -> Option A

4. Quick Check:

   Pod name first, then container and flags [OK]

Hint: Pod name first, then container (-c) and --follow [OK]

Common Mistakes:

• Placing flags before pod name
• Mixing order of container and follow flags
• Using unsupported shorthand flags