Kubernetes operations record logs in the following plain-text file.
/var/log/messagesThese logs can be browsed:
- Using the Grafana console, as explained in Browsing logs with Grafana.
- Using an external SIEM server, as explained in Browsing logs with a SIEM.
Each log entry follows this syntax.
<timestamp> <hostname> <application>[<processId>] <message>Where each field has the following value.
Field | Value |
|---|---|
<timestamp> | The time of the recorded event, in |
<hostname> | The system hostname |
<application> | The application name: |
<processId> | The process identifier |
<message> | The log message with details on the recorded event |
For example:
Starting Kubernetes
May 13 12:31:02 node00 k3s[3106]: time="2025-05-13T12:31:02Z" level=info msg="Starting k3s <VERSION> (546a94e9)"Kubernetes started
May 14 10:31:04 node00 systemd[1]: k3s.service: Succeeded.Kubernetes unexpected restart
Jan 10 11:19:57 node00 k3s[18176]: E0110 11:19:57.479645 18176 server.go:218] "Leaderelection lost"Starting etcd
May 13 12:31:03 node00 k3s[3106]: time="2025-05-13T12:31:03Z" level=info msg="Starting etcd for new cluster"Stopping Kubernetes
May 14 10:31:04 node00 k3s[1407839]: time="2025-05-14T10:31:04Z" level=info msg="stopping etcd"Node down
May 13 12:31:02 node00 k3s[10387]: I0507 12:31:02.356214 10387 event.go:294] "Event occurred" object="node02" fieldPath="" kind="Node" apiVersion="v1" type="Normal" reason="NodeNotReady" message="Node node02 status is now: NodeNotReady"No dedicated log record indicates that Kubernetes is stopped. Instead, Kubernetes is considered stopped by the Uninstall.Done log described in clusterctl log reference.