Blog

Logging Architecture

kubectl logs sounds simple, but behind it is a chain: the container writes stdout/stderr to a file on the node, kubelet reads that file back, and rotates it when full. This article traces a real log line from kubectl down to the file on the worker's disk, examines the CRI format and the symlink, then separates the two kinds of logs in a self-built cluster — container logs and system-component logs via journald — and why the cluster needs an agent to collect them.