Event inspection for diagnostics in Kubernetes - Commands & Configuration

Introduction

Sometimes things go wrong in Kubernetes, like pods not starting or crashing. Event inspection helps you see messages about what happened, so you can find and fix problems quickly.

When a pod is stuck in Pending or CrashLoopBackOff state and you want to know why.

When a deployment is not creating pods as expected and you need to check errors.

When you want to verify if a service or ingress has any warnings or issues.

When troubleshooting node problems that affect workloads.

When you want to audit recent changes or actions in your Kubernetes cluster.

Commands

This command lists recent events in the cluster, showing what happened and when. It helps you see warnings or errors quickly.

Terminal

kubectl get events

Expected Output

LAST SEEN   TYPE      REASON             OBJECT                  MESSAGE

2m          Warning   FailedScheduling   pod/my-pod              0/3 nodes are available: 3 Insufficient cpu.

1m          Normal    Pulled             pod/my-pod              Container image "nginx" already present on machine

30s         Normal    Created            pod/my-pod              Created container my-container

This command shows detailed information about the pod named 'my-pod', including events related to it at the bottom. It helps diagnose pod-specific issues.

Terminal

kubectl describe pod my-pod

Expected Output

Name:         my-pod

Namespace:    default

Status:       Pending

Containers:

  my-container:

    Image:      nginx

    State:      Waiting

      Reason:   Unschedulable

Events:

  Type     Reason            Age   From               Message

  ----     ------            ----  ----               -------

  Warning  FailedScheduling  2m    default-scheduler  0/3 nodes are available: 3 Insufficient cpu.

This command lists all events sorted by the time they were created, so you can see the order of events and find the latest issues easily.

Terminal

kubectl get events --sort-by='.metadata.creationTimestamp'

Expected Output

LAST SEEN   TYPE      REASON             OBJECT                  MESSAGE

5m          Normal    Scheduled          pod/my-pod              Successfully assigned default/my-pod to node-1

3m          Warning   FailedScheduling   pod/my-pod              0/3 nodes are available: 3 Insufficient cpu.

1m          Normal    Pulled             pod/my-pod              Container image "nginx" already present on machine

→

--sort-by - Sorts events by the specified field, here by creation time.

Key Concept

If you remember nothing else from this pattern, remember: Kubernetes events tell you what happened and why, so always check them first when diagnosing problems.

Common Mistakes

Only running 'kubectl get pods' and not checking events.

Pods may show errors or pending states without explaining why, so you miss the root cause.

Always run 'kubectl get events' or 'kubectl describe pod <pod-name>' to see detailed event messages.

Ignoring the timestamps and reading old events.

Old events may confuse you because they are not related to the current problem.

Use '--sort-by=.metadata.creationTimestamp' to see the latest events last.

Summary

Use 'kubectl get events' to see recent cluster events and spot warnings or errors.

Use 'kubectl describe pod <pod-name>' to get detailed pod info including related events.

Sort events by creation time with '--sort-by=.metadata.creationTimestamp' to focus on recent issues.