Collecting Cloud Service Mesh logs

The following sections explains how to gather the various Cloud Service Mesh logs fortroubleshooting issues or contactingGoogle Support.

Collect logs using the bug report tool

Cloud Service Mesh provides an automated bug report tool that collects the relevantdiagnostic logs and lets you attach the logs to a Google Support ticket.

Before you begin, ensure the kubeconfig context for your cluster is available inyour kubeconfig file.

Start the log collection

Upload your debug archive

The tool creates an archive of your mesh's logs and configuration in the workingdirectory. You can unpack the archive and use the troubleshooting guides toattempt to perform troubleshooting yourself. However, if you have a supportpackage, you can contactGoogle Cloud Support, who will provideyou with further steps to securely upload your log archive.

For details about how to interpret the log contents, seeInterpret Envoy logs.

Enable or disable Envoy logs

To enable the Envoy proxy access logs, configure anoverlay filefor in-cluster Cloud Service Mesh or aConfigMapfor managed Cloud Service Mesh.

Increase logging detail

To temporarily increase the detail level of the logs, use the following command.This setting is undone when the pod is recreated.

kubectl -nNAMESPACE debug --image istio/base --target istio-proxy -itPOD_NAME -- curl -X POST http://localhost:15000/logging?level=debug

To set the detail level of the logs back to default, use the following command:

kubectl -nNAMESPACE debug --image istio/base --target istio-proxy -itPOD_NAME -- curl -X POST http://localhost:15000/logging?level=info

Write Envoy logs to a folder

To collect the Envoy proxy access logs and store them in a folder, use thefollowing command:

kubectl logs -l app=APPLICATION_NAME -c istio-proxy > /FILE_PATH

SeeGetting Envoy's Access Logs for more information.

Kubernetes logs

Kubernetes generates several logs that contain information about the behavior ofIstio components, such asistiod, Ingress Gateway, and proxies. You can reviewthese logs for errors, which might narrow the scope of possible causes of a problem.

(In-cluster control plane only) Captureistiod logs using the following command:

kubectl -n istio-system logs $(kubectl -n istio-system get pods -lapp=istiod -oname) > ./LOGS_FOLDER/istiod.log

(In-cluster control plane only) Capture Istio Ingress Gateway logs using the following command:

kubectl -n istio-system logs $(kubectl -n istio-system get pods -lapp=istio-ingressgateway -oname) > /FILE_PATH

Capture Istio Proxy logs using the following command:

kubectl -nWORKLOAD_NAMESPACE logsPOD_NAME -c istio-proxy > ./LOGS_FOLDER/proxy.log

Kubernetes configuration dump

This information allows users without direct access to the cluster to view the state of various resources and identify possible configuration problems. The following command writes the Kubernetes configuration to a YAML file:

for ns in `kubectl get namespaces -o=jsonpath='{.items[*].metadata.name}'` ; do echo "===NAMESPACE===" $ns >> ./LOGS_FOLDER/kubernetes.yaml ;kubectl get -oyaml -n $ns deploy,statefulset,job,ingress,endpoints,configmap,event,secret,service,istio-io >> ./LOGS_FOLDER/kubernetes.yaml; done

Envoy core dump

Envoy core dumps are not typically useful to end users, however Google Supportmight request that you collect it as part of the troubleshooting process, usingthe following steps.

kubectl debug --image istio/base --target istio-proxy -itqPOD_NAME -nNAMESPACE -- curl 127.0.0.1:15000/ENDPOINT > out.log