How can I collect windows event logs (System event log, Application event log) from AKS pods?

Question

To debug a pod, we would require windows system event log and application event logs from that particular pod.

Is it possible to collect the above mentioned logs rather than using 'kubectl log' command?

Answer 1

kubectl log only collects the data from STDOUT & STDERR. As long as your application does not send logs to STDOUT & STDERR, you will be not able to see those with kubectl logs.

As a temp workaround you can use kubectl exec to locate your logfiles and then kubectl cp to copy those to your local pc.

A more sophisticated way would be a sidecar container which collects to logs and send it central logging solution.

A still suggest to use STDOUT & STDERR bcs this integrates with Azure Monitor & Insights.