<p>I have a kubernetes cluster in Azure (AKS) with the log analytics enabled. I can see that a lot of pods are being killed by OOMKilled message but I want to troubleshoot this with the log analytics from Azure. My question is how can I track or query, from the log analytics, all the pods that are killed by the <code>OOMKilled</code> reason?</p>
<p>Thanks!</p>

<p>The reason is somewhat hidden in the <code>ContainerLastStatus</code> field (JSON) of the <code>KubePodInventory</code> table. A query to get all pods killed with reason <code>OOMKilled</code> could be:</p>
<pre><code>KubePodInventory 
| where PodStatus != &quot;running&quot;
| extend ContainerLastStatusJSON = parse_json(ContainerLastStatus)
| extend FinishedAt = todatetime(ContainerLastStatusJSON.finishedAt)
| where ContainerLastStatusJSON.reason == &quot;OOMKilled&quot;
| distinct PodUid, ControllerName, ContainerLastStatus, FinishedAt
| order by FinishedAt asc
</code></pre>
