rio/retrieving-k8s-logs
dot_config/opencode/skills/retrieving-k8s-logs/SKILL.md
Retrieves Kubernetes container logs with various patterns including multi-container pods, previous container logs, init containers, and label-based aggregation. Use when checking application logs, debugging crashes, or analyzing container output.
$ install --global
skillsauthnpx skillsauth add rio/dotfiles retrieving-k8s-logsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 19, 2026, 3:05 AM15.5s1 file scanned
SKILL.md
- name:
- retrieving-k8s-logs
- description:
- Retrieves Kubernetes container logs with various patterns including multi-container pods, previous container logs, init containers, and label-based aggregation. Use when checking application logs, debugging crashes, or analyzing container output.
- allowed-tools:
- Bash
Retrieving Kubernetes Logs
Patterns for retrieving container logs effectively.
Basic Log Commands
# Current container logs
kubectl logs <pod> -n <ns>
# Last N lines
kubectl logs <pod> -n <ns> --tail=100
# Logs since time
kubectl logs <pod> -n <ns> --since=1h
kubectl logs <pod> -n <ns> --since=30m
# With timestamps
kubectl logs <pod> -n <ns> --timestamps
Multi-Container Pods
# List containers in pod
kubectl get pod <pod> -n <ns> -o jsonpath='{.spec.containers[*].name}'
# Logs from specific container
kubectl logs <pod> -n <ns> -c <container>
# Logs from all containers
kubectl logs <pod> -n <ns> --all-containers
Previous Container (After Crash)
# Logs from previous container instance (after restart/crash)
kubectl logs <pod> -n <ns> --previous
# Previous logs from specific container
kubectl logs <pod> -n <ns> -c <container> --previous
Use --previous when:
- Pod is in CrashLoopBackOff
- Container restarted and you need pre-crash logs
- Current container logs don't show the error
Init Container Logs
# List init containers
kubectl get pod <pod> -n <ns> -o jsonpath='{.spec.initContainers[*].name}'
# Get init container logs
kubectl logs <pod> -n <ns> -c <init-container-name>
Label-Based Log Aggregation
# Logs from all pods with label
kubectl logs -l app=<app-name> -n <ns>
# With tail limit per pod
kubectl logs -l app=<app-name> -n <ns> --tail=50
# All containers in labeled pods
kubectl logs -l app=<app-name> -n <ns> --all-containers
Searching Logs
# Grep for pattern
kubectl logs <pod> -n <ns> | grep -i error
# Grep with context
kubectl logs <pod> -n <ns> | grep -i -A5 -B5 "exception"
# Count occurrences
kubectl logs <pod> -n <ns> | grep -c "error"
Log Patterns for Debugging
Application Crash
# Get last 200 lines before crash
kubectl logs <pod> -n <ns> --previous --tail=200
# Look for error/exception
kubectl logs <pod> -n <ns> --previous | grep -i -E "error|exception|fatal|panic"
Startup Issues
# First 100 lines (startup)
kubectl logs <pod> -n <ns> | head -100
# Check init containers first
kubectl logs <pod> -n <ns> -c <init-container>
Intermittent Issues
# Logs from last 2 hours with timestamps
kubectl logs <pod> -n <ns> --since=2h --timestamps
# Tail and follow (for live debugging)
# Note: This blocks, use Ctrl+C to stop
kubectl logs <pod> -n <ns> -f --tail=50
Memory Issues (OOM)
# Check for memory-related messages before OOM
kubectl logs <pod> -n <ns> --previous | grep -i -E "memory|heap|oom|gc"
Log Output Formats
# Raw logs (default)
kubectl logs <pod> -n <ns>
# With pod name prefix (useful for multi-pod)
kubectl logs -l app=<app> -n <ns> --prefix
# Limit bytes (for huge logs)
kubectl logs <pod> -n <ns> --limit-bytes=50000
Quick Debugging Pattern
# 1. Check current logs for errors
kubectl logs <pod> -n <ns> --tail=100 | grep -i error
# 2. If pod crashed, check previous logs
kubectl logs <pod> -n <ns> --previous --tail=200
# 3. If init container failed
kubectl get pod <pod> -n <ns> -o jsonpath='{.spec.initContainers[*].name}'
kubectl logs <pod> -n <ns> -c <init-container>
# 4. Check all containers in pod
kubectl logs <pod> -n <ns> --all-containers --tail=50
Notes
--previousonly works if container restarted (keeps one previous log)- Logs are ephemeral; they're lost when pod is deleted
- For persistent logs, use a logging stack (EFK, Loki, etc.)
- Load
debugging-k8s-podsfor container state analysis
Related Skills
rio/handoff
documentation
VerifiedTrustedCommunity
Compact the current conversation into a handoff document for another agent to pick up.
40SKILL.mdUpdated May 22, 2026
rio/write-a-skill
development
VerifiedTrustedCommunity
Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.
40SKILL.mdUpdated May 17, 2026
rio/grill-me
testing
VerifiedTrustedCommunity
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
40SKILL.mdUpdated May 17, 2026
rio/exploring-cli-tools
tools
VerifiedTrustedCommunity
Explores CLI tools using --help flags and man pages to understand capabilities, discover subcommands, and find specific options. Use when investigating how a command-line tool works, checking if a tool supports a feature, or finding the correct syntax for a command.
39SKILL.mdUpdated Apr 19, 2026