Overview

Kubernetes logs allow you to locate and rectify faults. This section describes how you can manage Kubernetes logs in the following ways:

Use Cloud Native Logging to collect application logs and report them to LTS, which provides log statistics and analysis. For details, see Collecting Container Logs Using Cloud Native Logging.
(Not recommended) Connect CCE to AOM. For details, see Collecting Container Logs Using ICAgent (Not Recommended).
Collect control plane component logs and Kubernetes audit logs from the CCE control plane and add them to the LTS log streams in your account. For details, see Collecting Control Plane Component Logs and Collecting Kubernetes Audit Logs.
Collect Kubernetes events and add them to the LTS log stream in your account for persistent storage and statistical analysis. For details, see Collecting Kubernetes Events.

Comparison Between ICAgent and Cloud Native Logging

**Table 1** Comparison between ICAgent and Cloud Native Logging
Collection Tool	ICAgent		Cloud Native Logging
Log Storage Location	LTS	AOM	LTS	AOM
Content to Be Collected	- Container standard output logs - Container file logs - Node logs - Kubernetes events	- Container standard output logs - Container file logs	- Container standard output logs - Container file logs - Node logs - Kubernetes events	Kubernetes events
Advantages and Disadvantages	- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running. - You can specify a container whose logs are to be collected. - Docker and containerd are supported. If a node uses containerd, the ICAgent version must be 5.12.130 or later. - Container file log collection supports overlay2, not Device Mapper.	- Each workload needs to be configured separately. - Log collection policies are coupled with pods. Modifying policies will restart the pod.	- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running. - You can specify a container whose logs are to be collected. - If the node storage driver is Device Mapper, container file logs must be collected from the path where the data disk is attached to the node.	All warning events and some normal events are reported by default. The reported events can be used to configure alarms.
Configuration Method	Create a collection policy on LTS. For details, see Collecting Logs from CCE.	Create a collection policy in the workload. For details, see Collecting Container Logs Using ICAgent (Not Recommended).	Create a policy on the Logging page. For details, see Collecting Container Logs Using Cloud Native Logging.	For details, see Reporting Kubernetes Events to AOM.
Monitored Directories	Up to five levels of directories, with up to 1,000 files		Up to three levels of directories by fuzzy match	-
Monitored Files	Up to 20 logs from a volume mounting directory Up to 1,000 standard output logs in JSON format		Up to 4,096 logs collected based on log policies on each node	-