How to Retrieve Crash Logs of a Restarted Pod with kubectl --previous

When a pod is in a crash loop and the container keeps restarting, using kubectl logs often fails to capture the logs of the previous instance. The solution is to add the --previous flag, which tells kubelet to print logs from the prior container if it exists.

Using the --previous flag

Single‑container pod: kubectl logs pod-name --previous Multi‑container pod:

kubectl logs pod-name --previous -c container-name

Example:

NAME                     READY   STATUS    RESTARTS   AGE
nginx-7d8b49557c-c2lx9   2/2     Running   5          

kubectl logs nginx-7d8b49557c-c2lx9 --previous
Error: xxxxxxxxxxx

How kubelet implements --previous

Kubelet keeps the logs of the most recent failed containers under /var/log/pods/<pod‑name>. These files are symbolic links to the Docker container log files. A separate symlink points to the log of the previous (crashed) container, which is what --previous reads.

Listing a pod on the node shows the log files:

ls /var/log/pods/default_busybox_f72ab71a-5b3b-4ecf-940d-28a5c3b30683/busybox
2393.log  2394.log

The numbers indicate the restart count: 2393.log is the log after the 2393‑rd restart, and 2394.log after the 2394‑th restart.

These files are symlinks, for example:

/busybox# stat 2393.log
  File: 2393.log -> /data/kubernetes/docker/containers/68a5b32c9fdb.../68a5b32c9fdb...-json.log

/busybox# stat 2394.log
  File: 2394.log -> /data/kubernetes/docker/containers/2ed9ebf05852.../2ed9ebf05852...-json.log

Running docker ps -a shows the corresponding containers:

docker ps -a
CONTAINER ID   IMAGE        COMMAND      CREATED          STATUS                     NAMES
2ed9ebf05852   ff4a8eb070e1 "sleep 3600" 24 minutes ago   Up 24 minutes   k8s_busybox_busybox_default_..._2394
68a5b32c9fdb   ff4a8eb070e1 "sleep 3600" About an hour ago Exited (0) 24 minutes ago k8s_busybox_busybox_default_..._2393

When you run kubectl logs without --previous, it reads the current container’s log file (e.g., 2394.log). Adding --previous makes it read the previous container’s log file (e.g., 2393.log).

Verification by editing the log files

To confirm the behavior, the symlinked files were replaced with regular files containing custom JSON log entries. After recreating the files, the following commands demonstrated the expected output:

kubectl logs busybox
create by myself

kubectl logs busybox --previous
previous logs create by myself

Conclusion

Kubelet stores pod logs under /var/log/pods/. The --previous flag reads the log file pointed to by a dedicated symlink that references the last terminated container’s log, allowing you to retrieve crash logs that would otherwise be lost.