How to view Kubernetes logs, events, and pod metrics in real-time

Container insights includes the Live Data feature, which is an advanced diagnostic feature allowing you direct access to your Azure Kubernetes Service (AKS) container logs (stdout/stderror), events, and pod metrics. It exposes direct access to kubectl logs -c, kubectl get events, and kubectl top pods. A console pane shows the logs, events, and metrics generated by the container engine to further assist in troubleshooting issues in real-time.

This article provides a detailed overview and helps you understand how to use this feature.

For help setting up or troubleshooting the Live Data feature, review our setup guide. This feature directly access the Kubernetes API, and additional information about the authentication model can be found here.

View AKS resource live logs

Use the following procedure to view the live logs for pods, deployments, and replica sets with or without Container insights from the AKS resource view.

  1. In the Azure portal, browse to the AKS cluster resource group and select your AKS resource.

  2. Select Workloads in the Kubernetes resources section of the menu.

  3. Select a pod, deployment, replica-set from the respective tab.

  4. Select Live Logs from the resource's menu.

  5. Select a pod to start collection of the live data.

    Deployment live logs

View logs

You can view real-time log data as they are generated by the container engine from the Nodes, Controllers, and Containers view. To view log data, perform the following steps.

  1. In the Azure portal, browse to the AKS cluster resource group and select your AKS resource.

  2. On the AKS cluster dashboard, under Monitoring on the left-hand side, choose Insights.

  3. Select either the Nodes, Controllers, or Containers tab.

  4. Select an object from the performance grid, and on the properties pane found on the right side, select View live data option. If the AKS cluster is configured with single sign-on using Azure AD, you are prompted to authenticate on first use during that browser session. Select your account and complete authentication with Azure.

    Note

    When viewing the data from your Log Analytics workspace by selecting the View in analytics option from the properties pane, the log search results will potentially show Nodes, Daemon Sets, Replica Sets, Jobs, Cron Jobs, Pods, and Containers which may no longer exist. Attempting to search logs for a container which isn't available in kubectl will also fail here. Review the View in analytics feature to learn more about viewing historical logs, events and metrics.

After successfully authenticating, the Live Data console pane will appear below the performance data grid where you can view log data in a continuous stream. If the fetch status indicator shows a green check mark, which is on the far right of the pane, it means data can be retrieved and it begins streaming to your console.

Node properties pane view data option

The pane title shows the name of the pod the container is grouped with.

View events

You can view real-time event data as they are generated by the container engine from the Nodes, Controllers, Containers, and Deployments view when a container, pod, node, ReplicaSet, DaemonSet, job, CronJob or Deployment is selected. To view events, perform the following steps.

  1. In the Azure portal, browse to the AKS cluster resource group and select your AKS resource.

  2. On the AKS cluster dashboard, under Monitoring on the left-hand side, choose Insights.

  3. Select either the Nodes, Controllers, Containers, or Deployments tab.

  4. Select an object from the performance grid, and on the properties pane found on the right side, select View live data option. If the AKS cluster is configured with single sign-on using Azure AD, you are prompted to authenticate on first use during that browser session. Select your account and complete authentication with Azure.

    Note

    When viewing the data from your Log Analytics workspace by selecting the View in analytics option from the properties pane, the log search results will potentially show Nodes, Daemon Sets, Replica Sets, Jobs, Cron Jobs, Pods, and Containers which may no longer exist. Attempting to search logs for a container which isn't available in kubectl will also fail here. Review the View in analytics feature to learn more about viewing historical logs, events and metrics.

After successfully authenticating, the Live Data console pane will appear below the performance data grid. If the fetch status indicator shows a green check mark, which is on the far right of the pane, it means data can be retrieved and it begins streaming to your console.

If the object you selected was a container, select the Events option in the pane. If you selected a Node, Pod, or controller, viewing events is automatically selected.

Controller properties pane view events

The pane title shows the name of the Pod the container is grouped with.

Filter events

While viewing events, you can additionally limit the results using the Filter pill found to the right of the search bar. Depending on what resource you have selected, the pill lists a Pod, Namespace, or cluster to chose from.

View metrics

You can view real-time metric data as they are generated by the container engine from the Nodes or Controllers view only when a Pod is selected. To view metrics, perform the following steps.

  1. In the Azure portal, browse to the AKS cluster resource group and select your AKS resource.

  2. On the AKS cluster dashboard, under Monitoring on the left-hand side, choose Insights.

  3. Select either the Nodes or Controllers tab.

  4. Select a Pod object from the performance grid, and on the properties pane found on the right side, select View live data option. If the AKS cluster is configured with single sign-on using Azure AD, you are prompted to authenticate on first use during that browser session. Select your account and complete authentication with Azure.

    Note

    When viewing the data from your Log Analytics workspace by selecting the View in analytics option from the properties pane, the log search results will potentially show Nodes, Daemon Sets, Replica Sets, Jobs, Cron Jobs, Pods, and Containers which may no longer exist. Attempting to search logs for a container which isn't available in kubectl will also fail here. Review the View in analytics feature to learn more about viewing historical logs, events and metrics.

After successfully authenticating, the Live Data console pane will appear below the performance data grid. Metric data is retrieved and begins streaming to your console for presentation in the two charts. The pane title shows the name of the pod the container is grouped with.

View Pod metrics example

Using live data views

The following sections describe functionality that you can use in the different live data views.

The Live Data feature includes search functionality. In the Search field, you can filter results by typing a key word or term and any matching results are highlighted to allow quick review. While viewing events, you can additionally limit the results using the Filter pill found to the right of the search bar. Depending on what resource you have selected, the pill lists a Pod, Namespace, or cluster to chose from.

Live Data console pane filter example

Live Data console pane filter example for deployment

Scroll Lock and Pause

To suspend autoscroll and control the behavior of the pane, allowing you to manually scroll through the new data read, you can use the Scroll option. To re-enable autoscroll, simply select the Scroll option again. You can also pause retrieval of log or event data by selecting the the Pause option, and when you are ready to resume, simply select Play.

Live Data console pane pause live view

Live Data console pane pause live view for deployment

Important

We recommend only suspending or pausing autoscroll for a short period of time while troubleshooting an issue. These requests may impact the availability and throttling of the Kubernetes API on your cluster.

Important

No data is stored permanently during operation of this feature. All information captured during the session is deleted when you close your browser or navigate away from it. Data only remains present for visualization inside the five minute window of the metrics feature; any metrics older than five minutes are also deleted. The Live Data buffer queries within reasonable memory usage limits.

Next steps

  • To continue learning how to use Azure Monitor and monitor other aspects of your AKS cluster, see View Azure Kubernetes Service health.

  • View log query examples to see predefined queries and examples to create alerts, visualizations, or perform further analysis of your clusters.