Updated on 2025-09-05 GMT+08:00

Overview

Kubernetes logs allow you to locate and rectify faults. This section describes how to manage Kubernetes logs using different methods.

The following are Kubernetes log management methods:

Comparison Between ICAgent and Cloud Native Log Collection

Table 1 Comparison between ICAgent and Cloud Native Log Collection

Collection Tool

ICAgent

Cloud Native Log Collection

Log Storage Location

LTS

AOM 1.0

LTS

AOM 2.0

Content to Be Collected

- Container stdout logs

- Container file logs

- Node logs

- Kubernetes events

- Container stdout logs

- Container file logs

- Container stdout logs

- Container file logs

- Node logs

- Kubernetes events

- Kubernetes audit logs

- Control plane component logs

- Add-on logs

Kubernetes events

Advantages and Disadvantages

- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running.

- You can specify a container whose logs are to be collected.

- Docker and containerd are supported. If a node uses containerd, the ICAgent version must be 5.12.130 or later.

- Container file log collection supports overlay2, not Device Mapper.

- Each workload needs to be configured separately.

- Log collection policies are coupled with pods. Modifying policies will restart the pod.

- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running.

- You can specify a container whose logs are to be collected.

- If the node storage driver is Device Mapper, container file logs must be collected from the path where the data disk is attached to the node.

All warning events and some normal events are reported by default. The reported events can be used to configure alarms.

Configuration Method

Create a collection policy on LTS. For details, see Ingesting CCE Application Logs to LTS.

Create a collection policy in the workload. For details, see Collecting Container Logs Using ICAgent (Not Recommended).

Create a policy on the Logging page. For details, see Collecting Container Logs Using the Cloud Native Log Collection Add-on.

For details, see Reporting Kubernetes Events to AOM.

Monitored Directories

Up to five levels of directories, with up to 1,000 files

Up to three levels of directories by fuzzy match

-

Monitored Files

  • Up to 20 logs from a volume mounting directory
  • Up to 1,000 stdout logs in JSON format

Up to 4,096 logs collected based on log policies on each node

-