<p>We had a system outage, service was unresponsive and I restarted the service with <code>kubectl rollout restart sts myservice</code> and it worked. However, I want to look at the logs to see a cause of the problem. When I try <code>kubect logs --previous myservice-0</code> it says 'previous terminated container &quot;mycontainer&quot; in pod &quot;myservice-0&quot; not found'. Is there a way to find the logs before the restart? I tried to look at the dead docker containers (<code>docker ps -a</code>), there are containers exited 6 month ago, but no recently exited containers of my service, why is so?</p>

<p>I suggest the following reading: <a href="https://sematext.com/guides/kubernetes-logging/" rel="noreferrer">The Complete Guide to Kubernetes Logging</a>:</p>
<blockquote>
<p>In Kubernetes, when pods are evicted, crashed, deleted, or scheduled
on a different node, <strong>the logs from the containers are gone</strong>. The system
cleans up after itself. Therefore you lose any information about why
the anomaly occurred.</p>
</blockquote>
<p>Also, as per <a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/" rel="noreferrer">Logging Architecture</a>:</p>
<blockquote>
<p>If you want to access the application's logs if a container crashes; a
pod gets evicted; or a node dies, [...] you need a separate backend to
store, analyze, and query logs. Kubernetes does not provide a native
storage solution for log data. Instead, there are many logging
solutions that integrate with Kubernetes.</p>
</blockquote>
<p>Some example of those log aggregation solutions are:</p>
<ul>
<li>The <a href="https://www.elastic.co/what-is/elk-stack" rel="noreferrer">ELK Stack</a> (Elasticsearch, Logstash, Kibana)</li>
<li>The <a href="https://docs.openshift.com/container-platform/3.11/install_config/aggregate_logging.html" rel="noreferrer">EFK Stack</a> (Elasticsearch, Fluentd, Kibana)</li>
</ul>
