KDT allows you to obtain log files that contain diagnostic information about Kaspersky Next XDR Expert components and the Kubernetes cluster, to troubleshoot problems on your own or with the help of Kaspersky Technical Support.
Kaspersky Next XDR Expert generates the log file names according to the following template: pod_name.container_name.log. Here, pod_name is a Kubernetes pod name, and container_name is a Kubernetes container name.
To obtain log files of Kaspersky Next XDR Expert components and management web plug-ins,
On the administrator host where the KDT utility is located, run the following command:
./kdt logs get <flags>
Where <flags> are the parameters of the command that allow you to configure the logging result.
You can specify the following logging parameters:
--app <list_of_components>—Obtain logs for the listed Kaspersky Next XDR Expert components.--auto-dest-dir—Obtain logs and save them to the kdt-default-logs-<current_date_and_time> directory that is automatically created in the current directory. If the logging period is not specified, you obtain diagnostic information for the last hour.For example, if you want to obtain logs for the last hour for Administration Server and KUMA, and then save these logs to the automatically created directory, run the following command:
./kdt logs get --app ksc,kuma --auto-dest-dir
-d, --destination <file_path>—Obtain logs and save them to the specified file.-D, --destination-dir <directory_path>—Obtain logs and save them to the specified directory that must be created beforehand. If the <directory_path> is empty, logs are saved in the standard output stream (stdout). If the logging period is not specified, you obtain diagnostic information for the last hour.--to-archive—Obtain logs and save them to the kdt-default-logs-<current_date_and_time>.tar.gz archive. The created archive is saved to the current directory. If the logging period is not specified, you obtain diagnostic information for the last hour.--last=<hours>h—Obtain logs for the specified number of hours up to date.For example, if you want to get an archive with logs for the last three hours, run the following command:
./kdt logs get --to-archive --last=3h
--start=<date_and_time>—Obtain logs starting from the specified date and time (in the Unix timestamp format) to the present time, or to the date and time specified in the --end parameter.For example, if you want to obtain logs starting from 03/26/2024 10:00:00 to the present time, and then save them to the kdt-default-logs-<current_date_and_time> directory created in the current directory, run the following command:
./kdt logs get --auto-dest-dir --start=1711447200
--end=<date_and_time>—Obtain logs starting from the date and time specified in the --start parameter to the date and time specified in the --end parameter (in the Unix timestamp format). If the --start parameter in not specified, logs are obtained for the last hour before the date and time specified by the --end parameter.For example, if you want to save logs for the 10 minutes (from 03/26/2024 10:00:00 to 03/26/2024 10:10:00) to the logs directory, run the following command:
./kdt logs get -D ./logs/ start=1711447200 --end=1711447800
To view the available logging parameters, you can run one of the following commands:
./kdt logs get -h./kdt logs get --help