Trung Tran:
Hello guys, I need your help.
When troubleshooting the issue with cluster, what is the use case we need to use journalctl ?
Andrés Torres:
journalctl is used to see the logs from a service running on the node
Andrés Torres:
Some controlplane components may run as a pod in the cluster like the kube-apiserver or as a Linux service
Andrés Torres:
If it runs as a service you use journalctl , if it runs as a pod you use kubectl logs
Trung Tran:
Noted, thanks for the explanation @Andrés Torres, all the best!
Pedro B.:
the command is journalctl -u SERVICE_NAME it can be for example kubelet, or kubectl as mentioned
Alistair Mackay:
And depending on how verbose a service’s logs are, journalctl can output a lot of logs! Especially when most services retry a failed startup every few seconds till you fix or explicitly stop the service.
Tip - kubelet is always a service, so its logs are in journalctl.
If you’re debugging a kubelet failure to start, then this will get you the bit of the log you need:
sudo systemctl stop kubelet
d=$(date +"%Y-%m-%d %H:%M:%S")
sudo systemctl start kubelet
sleep 1
sudo journalctl -u kubelet --since "$d"