Kubernetes Logging /var/log/containers ==> default log location on nodes. Last two log files are retained on the node. In order to aggregate logs from varies sources like pods, containers , nodes, control plane and events we use fluentd and elastic search for searching and grafana for visualization. Logging Architecture - Nodes: Kubectl logs $POD_NAME ==> accessing pod logs Kubectl logs $POD_NAME -c $CONTAINER_NAME ==> specific container inside a pod. Kubectl logs $POD_NAME --all-containers Kubectl logs $POD_NAME --all-containers --follow ==> real time logs Kubectl logs --selector app=backend --all-containers When an api server is down then in that case we cannot use kubectl get logs instead we can log in to a node and directly run docker logs $CONTAINER_NAME What if docker is not available? tail -f /var/log/containers/$CONTAINER_NAME$CONTAINER_ID Logging Architecture - Control Plane: Get a list of control plane pods using a selector kubectl get pods --namespace kube-syst