Updated on 2026-04-03 GMT+08:00

Overview

Kubernetes logs allow you to locate and rectify faults. This section describes how to manage Kubernetes logs using different methods.

Comparison Between ICAgent and Cloud Native Log Collection

Table 1 Comparison between ICAgent and Cloud Native Log Collection

Collection Tool

ICAgent

Cloud Native Log Collection

Log Storage Location

LTS

AOM 1.0 (not recommended)

LTS

AOM 2.0

Content to Be Collected

- Container stdout logs

- Container file logs

- Node logs

- Kubernetes events

- Container stdout logs

- Container file logs

- Container stdout logs

- Container file logs

- Node logs

- Kubernetes events

- Kubernetes audit logs

- Control plane component logs

- Add-on logs

Kubernetes events

Advantages and Disadvantages

- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running.

- You can specify a container whose logs are to be collected.

- Docker and containerd are supported. Nodes using containerd require ICAgent v5.12.130 or later.

- Container file log collection supports overlay2, not Device Mapper.

- Each workload needs to be configured separately.

- Log collection policies are coupled with pods. Modifying policies will restart the pod.

- Log collection policies and workloads are configured separately. Modifying policies does not affect pod running.

- You can specify a container whose logs are to be collected.

- If the node storage driver is Device Mapper, container file logs must be collected from the path where the data disk is attached to the node.

All warning events and some normal events are reported by default. The reported events can be used to configure alarms.

Configuration Method

Create a collection policy in LTS. For details, see Ingesting CCE Application Logs to LTS.

For details, see Reporting Kubernetes Events to AOM.

Monitored Directories

Up to five levels of directories, with up to 1,000 files

Up to three levels of directories by fuzzy match

-

Monitored Files

  • Up to 20 logs from a volume mounting directory
  • Up to 1,000 stdout logs in JSON format

Up to 4,096 logs collected based on log policies on each node

-