使用kubectl獲取pod日志小技巧分享

更新時(shí)間：2026年02月25日 08:56:08 作者：lv2

文章介紹了如何使用kubectl命令查看K8S中Pod的日志,包括獲取單個(gè)Pod日志、同一deployment下多個(gè)副本Pod的日志、最近xx行日志、最近一段時(shí)間的日志、上一個(gè)崩潰但還存在的Pod的日志、指定或所有容器的日志以及持續(xù)獲取Pod日志的方法

1. 前言

如何查看k8s中pod的console控制臺(tái)日志？即類似于docker logs查看容器日志一樣；可以使用 kubectl 命令，查看K8S中 Pod的日志。

在這里，將通過kubectl獲取 Pod 的日志，包括當(dāng)前運(yùn)行、同一deployment下所有副本的日志。

2. kubectl logs

2.1 創(chuàng)建示例

創(chuàng)建nginx deployment，副本為2

 $ kubectl create deployment my-dep --image=nginx --replicas=2
 $ kubectl get pod 
NAME                      READY   STATUS    RESTARTS   AGE
my-dep-5b7868d854-8d5kf   1/1     Running   0          28m
my-dep-5b7868d854-q6lj7   1/1     Running   0          21m

2.2 獲取單個(gè)pod日志

語(yǔ)法： kubectl logs <pod>

# 示例
$ kubectl logs my-dep-5b7868d854-8d5kf 
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/07/26 01:18:56 [notice] 1#1: using the "epoll" event method

2.3 獲取同一deployment下多個(gè)副本pod的日志

語(yǔ)法： kubectl logs -l <key>=<value>

# 示例
# 獲取pod labels 
$ kubectl get pod --show-labels
NAME                      READY   STATUS    RESTARTS   AGE   LABELS
my-dep-5b7868d854-8d5kf   1/1     Running   0          33m   app=my-dep,pod-template-hash=5b7868d854
my-dep-5b7868d854-q6lj7   1/1     Running   0          26m   app=my-dep,pod-template-hash=5b7868d854

# 獲取多個(gè)Pod日志
$ kubectl logs -l app=my-dep
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/07/26 01:18:56 [notice] 1#1: using the "epoll" event method
2022/07/26 01:18:56 [notice] 1#1: nginx/1.23.1
2022/07/26 01:18:56 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2022/07/26 01:18:56 [notice] 1#1: OS: Linux 4.15.0-122-generic
2022/07/26 01:18:56 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/07/26 01:18:56 [notice] 1#1: start worker processes
2022/07/26 01:18:56 [notice] 1#1: start worker process 31
2022/07/26 01:18:56 [notice] 1#1: start worker process 32
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/07/26 01:25:33 [notice] 1#1: using the "epoll" event method
2022/07/26 01:25:33 [notice] 1#1: nginx/1.23.1
2022/07/26 01:25:33 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2022/07/26 01:25:33 [notice] 1#1: OS: Linux 4.15.0-122-generic
2022/07/26 01:25:33 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/07/26 01:25:33 [notice] 1#1: start worker processes
2022/07/26 01:25:33 [notice] 1#1: start worker process 30
2022/07/26 01:25:33 [notice] 1#1: start worker process 31

2.4 獲取pod最近xx行日志

語(yǔ)法：kubectl logs --tail=xx <pod>

# 獲取pod最近5行日志
$ kubectl logs --tail=5 my-dep-5b7868d854-8d5kf 
2022/07/26 01:18:56 [notice] 1#1: OS: Linux 4.15.0-122-generic
2022/07/26 01:18:56 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/07/26 01:18:56 [notice] 1#1: start worker processes
2022/07/26 01:18:56 [notice] 1#1: start worker process 31
2022/07/26 01:18:56 [notice] 1#1: start worker process 32

2.5 獲取最近一段時(shí)間的日志

語(yǔ)法：kubectl logs --since=1h/m <pod>

# 獲取最近1分鐘/小時(shí)的日志
$ kubectl logs my-dep-5b7868d854-8d5kf --since=1m
$ kubectl logs my-dep-5b7868d854-8d5kf --since=1h

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2022/07/26 01:18:56 [notice] 1#1: using the "epoll" event method
2022/07/26 01:18:56 [notice] 1#1: nginx/1.23.1
2022/07/26 01:18:56 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) 
2022/07/26 01:18:56 [notice] 1#1: OS: Linux 4.15.0-122-generic
2022/07/26 01:18:56 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2022/07/26 01:18:56 [notice] 1#1: start worker processes
2022/07/26 01:18:56 [notice] 1#1: start worker process 31
2022/07/26 01:18:56 [notice] 1#1: start worker process 32

2.6 kubectl logs --previous

獲取上一個(gè)崩潰但還存在的pod的日志，說實(shí)在的，不是很懂，官方的解釋是：--previous=false: If true, print the logs for the previous instance of the container in a pod if it exists.

意思是：上一個(gè)崩潰過，但還存在的實(shí)例的日志。暫無(wú)場(chǎng)景重現(xiàn)。略過

2.7 獲取pod中指定或所有容器的日志

查看指定容器日志語(yǔ)法：kubectl logs <pod> -c <contianer>

# 獲取pod中容器名
$ kubectl get pods my-dep-5b7868d854-8d5kf -o jsonpath={.spec.containers[*].name}
nginx
# 獲取指定容器日志
 kubectl logs my-dep-5b7868d854-8d5kf -c nginx

查看同一個(gè)Pod中所有容器日志語(yǔ)法：kubectl logs <pod> --all-containers

$ kubectl logs my-dep-5b7868d854-8d5kf --all-containers

2.8 持續(xù)獲取Pod日志

語(yǔ)法：kubectl logs -f <pod>

$ kubectl logs -f my-dep-5b7868d854-8d5kf

3. 附官方命令解釋

kubectl logs --help

 -c, --container="": 容器名。
  -f, --follow[=false]: 指定是否持續(xù)輸出日志。
      --interactive[=true]: 如果為true，當(dāng)需要時(shí)提示用戶進(jìn)行輸入。默認(rèn)為true。
      --limit-bytes=0: 輸出日志的最大字節(jié)數(shù)。默認(rèn)無(wú)限制。
  -p, --previous[=false]: 如果為true，輸出pod中曾經(jīng)運(yùn)行過，但目前已終止的容器的日志。
      --since=0: 僅返回相對(duì)時(shí)間范圍，如5s、2m或3h，之內(nèi)的日志。默認(rèn)返回所有日志。只能同時(shí)使用since和since-time中的一種。
      --since-time="": 僅返回指定時(shí)間（RFC3339格式）之后的日志。默認(rèn)返回所有日志。只能同時(shí)使用since和since-time中的一種。
      --tail=-1: 要顯示的最新的日志條數(shù)。默認(rèn)為-1，顯示所有的日志。
      --timestamps[=false]: 在日志中包含時(shí)間戳。