Skip to content

Kjournal clusteraudit

kjournal clusteraudit

Get cluster audit events

Synopsis

The clusteraudit command fetchs events from alle resources without a namespace

kjournal clusteraudit [flags]

Examples

  # Stream cluster events from the last 48h
  kjournal clusteraudit --since 48h

  # Stream events for all clusterroles
  kjournal clusteraudit clusterroles

  # Stream events for the namespace abc
  kjournal clusteraudit namespaces/abc

Options

      --chunk-size int          Return large lists in chunks rather than all at once. Pass 0 to disable. This has no impact as long as --no-stream is not set. (default 500)
      --field-selector string   Selector (field query) to filter on, supports '=', '==', '!=', '!=', '>' and '<'. (e.g. --field-selector key1=value1,key2=value2).
  -h, --help                    help for clusteraudit
      --no-header               skip the header when printing the results
      --no-stream               By default all logs are streamed. This behaviour can be disabled. Be mindful that this can lead to an increased memory usage and no output while logs are beeing gathered
  -o, --output string           Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file, custom-columns-file, custom-columns, wide). See custom columns [https://kubernetes.io/docs/reference/kubectl/overview/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [https://kubernetes.io/docs/reference/kubectl/jsonpath/].
      --since --since=now-24h   Change the time range from which logs are received. (e.g. --since=now-24h)
  -w, --watch                   After dumping all existing logs keep watching for newly added ones

Options inherited from parent commands

      --as string                      Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
      --as-group stringArray           Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string                  UID to impersonate for the operation.
      --cache-dir string               Default cache directory (default "/home/raffi/.kube/cache")
      --certificate-authority string   Path to a cert file for the certificate authority
      --client-certificate string      Path to a client certificate file for TLS
      --client-key string              Path to a client key file for TLS
      --cluster string                 The name of the kubeconfig cluster to use
      --context string                 The name of the kubeconfig context to use
      --insecure-skip-tls-verify       If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
      --kubeconfig string              Path to the kubeconfig file to use for CLI requests.
  -n, --namespace string               If present, the namespace scope for this CLI request
      --server string                  The address and port of the Kubernetes API server
      --timeout duration               timeout for this operation (default 5m0s)
      --tls-server-name string         Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
      --token string                   Bearer token for authentication to the API server
      --user string                    The name of the kubeconfig user to use
      --verbose                        print generated objects

SEE ALSO

  • kjournal - Command line utility for accessing long-term kubernetes logs