How to Retrieve Logs from Crashed Kubernetes Pods Using kubectl --previous

Scenario

When a pod is in a crash state and the container keeps restarting, using kubelet logs may never capture the logs.

Solution

Use the kubectl logs --previous command. The --previous flag prints the logs for the previous instance of the container in a pod, if it exists.

Single‑container pod: kubectl logs pod-name --previous Multi‑container pod:

kubectl logs pod-name --previous -c container-name

Example:

NAME                     READY   STATUS    RESTARTS   AGE
nginx-7d8b49557c-c2lx9   2/2    Running   5          

kubectl logs nginx-7d8b49557c-c2lx9 --previous
Error: xxxxxxxxxxx

Principle

kubelet keeps the logs of the most recent failed containers. The logs are stored under /var/log/pods/podname as symbolic links to the Docker container log files. When --previous is used, kubelet reads the linked file of the last exited container.

Practice

List pods on a node:

ubuntu@~$ kubelet get pod
NAME                     READY   STATUS    RESTARTS   AGE
busybox                  1/1     Running   2394       99d
nginx-deployment-6wlhd   1/1     Running   0          79d
redis                    1/1     Running   0          49d

On the node, view the log files stored by kubelet:

ls /var/log/pods/default_busybox_f72ab71a-5b3b-4ecf-940d-28a5c3b30683/busybox
2393.log  2394.log

The numbers indicate the restart count; 2393.log is the log after the 2393rd restart, and 2394.log after the 2394th.

These files are symbolic links to Docker’s JSON log files. Reading the current container’s logs uses the current file, while adding --previous reads the linked file of the previous container.

Manual verification by editing the linked files shows that kubectl logs reads the content of the linked files correctly.

Conclusion

kubelet reads log files from /var/log/pods/. The --previous flag also reads from this directory, using a dedicated symbolic link that points to the log file of the last exited container, allowing you to retrieve logs from a crashed pod.