---
title: "Cluster logs"
sidebar_label: "Logs in a Managed Kubernetes cluster"
sidebar_position: 4
description: "How to view cluster logs, configure container log retrieval via Filebeat, and export audit logs"
---

import Formbricks from '@theme/MDXComponents/Formbricks';
import { CustomTable } from 'docs-kit/components';

# Logs in a Managed Kubernetes cluster

In Managed Kubernetes clusters, you can retrieve:

* [cluster logs](#cluster-logs);
* [container logs](#container-logs);
* [pod and service logs (audit logs)](#pods-and-services-logs).

## Cluster logs \{#cluster-logs}

The cluster logs display events that occur in the cluster. For example, creating a cluster, changing node groups, and updating certificates and versions. If a request was performed automatically, for example, a scheduled certificate update occurred, this action will also be logged. You can:

* [view cluster logs in the event log](#view-cluster-logs-in-event-log);
* [export audit logs](#export-audit-logs) in the [Audit Logs](/audit-logs/) service.

Logs in the Audit Logs service are more detailed than logs in the event log. A full list of events in the Audit Logs service can be viewed in the [MKS service](/audit-logs/events.mdx#managed-kubernetes) instruction subsection [Events in audit logs](/audit-logs/events.mdx).

### View cluster logs in the event log \{#view-cluster-logs-in-event-log}

1. In the [Control panel](https://my.selectel.ru/mks/), on the top menu, click **Products** and select **Managed Kubernetes**.

2. In the **Clusters** section, open the cluster page → tab **Event Log**.

3. View the status of cluster events in the event row → column **Status**.

   <CustomTable>
     <table>
       <tbody>
         <tr>
           <th>IN\_PROGRESS</th><td>Event is in progress</td>
         </tr>

         <tr>
           <th>IN\_QUEUE</th><td>The event is in the queue. Event completion with status `IN_PROGRESS` is expected</td>
         </tr>

         <tr>
           <th>CANCELED</th><td>Event is canceled</td>
         </tr>

         <tr>
           <th>ERROR</th><td>An error has occurred. If the cause of the error is insufficient project quotas, [increase the quotas](/access-control/projects/quotas.mdx#change-quotas). If the cause is not specified, [create a ticket](https://my.selectel.ru/tickets/create/)</td>
         </tr>

         <tr>
           <th>DONE</th><td>Event completed successfully</td>
         </tr>
       </tbody>
     </table>
   </CustomTable>

### Export audit logs in the Audit Logs service \{#export-audit-logs}

Use the instructions in the [Export audit logs section](/audit-logs/export-logs/).

## Container logs \{#container-logs}

Container logs contain events that occur with containers. For example, container creation and deletion. Log files are stored in the `/var/log/pods/` or `/var/log/containers` directory. Logs for an individual container can be viewed using `kubectl logs <container_name>`, where `<container_name>` is the container name. If your Managed Kubernetes cluster has many containers, you can [configure container log collection via Filebeat](#receive-container-logs-via-filebeat).

### Configure container logs to be received via Filebeat \{#receive-container-logs-via-filebeat}

[Filebeat](https://www.elastic.co/beats/filebeat) is configured by default to work with Docker. In Selectel, instead of Docker, the container runtime ([CRI](https://kubernetes.io/docs/setup/production-environment/container-runtimes/)) used is [containerd](https://containerd.io/).

To configure the mechanism for receiving log metadata via Filebeat, use the configuration file:

```yaml
filebeat.inputs:
- type: container
  fields_under_root: true
  paths:
  - "/var/log/containers/*.log"
  processors:
    - add_kubernetes_metadata:
        host: ${NODE_NAME}
        in_cluster: true
        default_matchers.enabled: false
        matchers:
        - logs_path:
            logs_path: "/var/log/containers/"
```

## Pod and service logs (audit logs) \{#pods-and-services-logs}

Audit logs display events that occur in the cluster, for example, in pods or services. These events can be initiated by users, applications, or the Control Plane. The list of events included in the logs and their parameters depend on the policy.  The policy applied to Managed Kubernetes audit logs can be viewed in the [audit-policy.yaml](https://github.com/selectel/mks-audit-logs-manifest/blob/main/audit-policy.yaml) file in the Selectel documentation on GitHub. Read more about the policy in the [Audit policy](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy) section of the [Auditing](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/) article in the Kubernetes documentation.

Audit logs can be sent to log storage and analysis systems, such as:

* external data storage, such as ELK or Stackdriver;
* or SIEM systems, e.g., MaxPatrol SIEM or KUMA.

To receive audit logs from a Managed Kubernetes cluster in a log storage and analysis system, [configure the integration](#configure-integration-with-external-system).

### Configure integration with a log storage and analysis system \{#configure-integration-with-external-system}

Audit logs are available in clusters with Kubernetes version 1.28 and higher. In Managed Kubernetes clusters on cloud servers, you can [upgrade the cluster version](/managed-kubernetes/clusters/upgrade-version.mdx). During the version upgrade, audit logs are unavailable.

1. [Check the log storage and analysis system](#check-external-system).
2. Enable audit logs when [creating a cluster](/managed-kubernetes/create/create-cloud-cluster.mdx) or in an [existing cluster](#enable-audit-logs-in-existing-cluster).
3. [Connect to the cluster](#connect-to-cluster).
4. [Configure the export of audit logs to a log storage and analysis system](#configure-export-of-audit-logs).

#### 1. Check the log storage and analysis system \{#check-external-system}

Make sure that your log storage and analysis system is accessible via HTTPS and that TLS connection termination is configured for it.

#### 2. Enable audit logs in an existing cluster \{#enable-audit-logs-in-existing-cluster}

1. In the [Control panel](https://my.selectel.ru/mks/), on the top menu, click **Products** and select **Managed Kubernetes**.
2. In the **Clusters** section, open the cluster page → tab **Settings**.
3. In the **Logging** block, turn on the **Audit logs** switch.

#### 3. Connect to the cluster \{#connect-to-cluster}

Use the [Connect to cluster](/managed-kubernetes/clusters/connect-to-cluster.mdx) instruction for the required operating system.

#### 4. Configure the export of audit logs to the log storage and analysis system \{#configure-export-of-audit-logs}

Audit logs will start being sent to the log storage and analysis system once a Secret object is created.

1. Create a YAML file with a manifest for the Secret object:

   ```yaml
   apiVersion: v1
   kind: Secret
   metadata:
     name: mks-audit-logs
   data:
     host: <host>
     port: <port>
     username: <username>
     password: <password>
     ca.crt: <ca_certificate>
   ```

   Specify:

   * `<host>` — DNS or IP address of the log storage and analysis system;
   * `<port>` — port for connecting to the log storage and analysis system;
   * optional: `<username>` — username for the log storage and analysis system;
   * optional: `<password>` — password for the log storage and analysis system;
   * optional: `<ca_certificate>` — certificate from a private certificate authority (CA). If a Let's Encrypt certificate is used for the connection, this parameter does not need to be filled in.

2. Apply the manifest and create a Secret object in the `kube-system:` namespace:

   ```bash
   kubectl apply -f <file_name> --namespace=kube-system
   ```

   Specify `<file_name>` — the name of the YAML file with the manifest to create a new Secret object. For example, `secret.yaml`.

3. Check that the Secret object has been created:

   ```bash
   kubectl get secret mks-audit-logs --output=yaml --namespace=kube-system
   ```

<Formbricks />