Search code examples
azure-devopsazure-aksazure-log-analyticslog-shippingazure-sentinel

Azure AKS in-container logs to Azure Logs/Azure Sentinel

Is there an dynamic way to pull log data from inside my containers?

All of my searches are returning that Azure Logs/Azure Sentinel can read data about AKS relative to the containers as they exist in K8s (online, running, failed, etc.) but not the actual in-container logs. Examples of results asking for this:

...all of these provide documentation on monitoring containers (as they live in K8s) but not the app-level logs in the containers...

Is anyone aware of a technology or capability for Azure Logs/Azure Sentinel to consume in-container, on-disk container logs (e.g. inside the container: /var/log, /var/application/logs, etc.)?

Thanks!

Solution

  • Ok so I'd forgotten about this question but just to post an answer. I kinda used what @kedmardemootoo suggested, where we use the standard log output from a container to read the file.

    however, the main difference is I used the K8s sidecar pattern to monitor log files in my container so that I could do a kubectl logs output exclusively to a particular log file.

    The manifest changes looks like:

    enter image description here

    while we're using a BusyBox image, Alpine would also work fine. The idea is that it's a tiny OS image so you don't explode your worker node processor/memory utilization but echo's a particular log's output to STDOUT so it can be captured by Azure Log Analytics (AZA). Use a tiny linux OS that just tails a particular log file (with a container name that reflects the log file being tail'd) and it will show up under that container's log entries in AZA.

    FYI -- BusyBox and Alpine are like 3-5MB sized container images.