Where does kubectl events originate from? How do I export these?

7/27/2018

Where are these stored? Is there a recommended way to export them for analysis purposes?

I'm referring to the data from kubectl get events.

-- Chris Stryczynski
kubernetes

1 Answer

7/27/2018

Where are these stored?

If you run kubectl get events --v=9 you will observe that there is actual api call behind it:

GET /api/v1/namespaces/default/events?limit=500

You can use api to extract details as described in the official documenatation.

As for storage, they are kept in etcd cluster. As an excerpt from discussion about events here is relevant part to your question:

Kubernetes only use etcd's lease API for creating event objects.
Event objects' lease lasts for 1 hour and doesn't need good precision.

You now have two paths around this:

  • pull events using api (I'd probably do this for analysis purposes since this is what actually gets relayed by kubectl command)
  • query etcd cluster (if you want more granular control over data processing)
-- Const
Source: StackOverflow