When I run
$ kubectl logs <container>
I get the logs of my pods.
But where are the files for those logs?
Some sources says /var/log/containers/ others says /var/lib/docker/containers/ but I couldn't find my actual application's or pod's log.
The on-disk filename comes from
docker inspect $pod_name_or_sha | jq -r '.[0].LogPath'
assuming the docker daemon's configuration is the default {"log-driver": "json-file"}, which is almost guaranteed to be true if kubectl logs behaves correctly.
This may also go without saying, but you must be on the Node upon which the Pod was scheduled for either docker inspect, or sniffing around for the presence of log files on disk, to do anything helpful. kubectl describe pod $pod_name will render the Node name, or as you might suspect it'll be in kubectl get -o json pod $pod_name if you wish to acquire it programmatically.
Do you see anything in those directories?
In my clusters, the stdout/stderr logs from each pod are in /var/log/containers, however there is some linking/redirection:
/var/log/containers/<pod-name>_<namespace>_<container-name-container-id>.log -> /var/log/pods/<some-uuid>/<container-name>_0.log
And that log is actually linked into /var/lib/docker:
<container-name>_0.log -> /var/lib/docker/containers/<container-id>/<container-id>-json.log
Logs are managed by the kubelet on each node. When you run kubectl logs <pod>, it passes the request to the kubelet on the node where your pod is running, and reads the associated logfile.
You can see the architecture here
来源：https://stackoverflow.com/questions/47915287/where-are-kubernetes-pods-logfiles