I had a few pods restarting in my EKS cluster. I could see that they were SIGKILL'ed by K8s. Now I would like to know the reason but I can't because the Kubernetes events TTL is only one hour.

I am checking the control plane logs for the EKS cluster in CloudWatch now but don't know which of them contains these messages as well.

Which of the logs does contain these events form K8s?

CodePudding user response：

Yes you are right, the default value of --event-ttl is 60m00s, and unfortunately, there is currently no any native option to change that value in EKS. The github issue is still opened without any promising timeframes.

As per guide you sent and as per Streaming EKS Metrics and Logs to CloudWatch, if you configured everything correctly, you can find logs under “Container Insights” from the drop-down menu.

Logs you might want to check are

• Control plane logs consist of scheduler logs, API server logs, and audit logs.
• Data plane logs consist of kubelet and container runtime engine logs.

Can you please specify what exact logs you have in your cloudwatch control plane logs and what you already checked? Maybe that will help