<p>I had a few pods restarting in my EKS cluster. I could see that they were SIGKILL'ed by K8s. Now I would like to know the reason but I can't because the Kubernetes events TTL is only one hour.</p>
<p>I am checking the <a href="https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html" rel="nofollow noreferrer">control plane logs</a> for the EKS cluster in CloudWatch now but don't know which of them contains these messages as well.</p>
<p>Which of the logs does contain these events form K8s?</p>

Hedge
<p>Yes you are right, the default value of <code>--event-ttl</code> is <code>60m00s</code>, and unfortunately, there is currently  <a href="https://github.com/aws/containers-roadmap/issues/785" rel="nofollow noreferrer">no any native option to change that value in EKS</a>. The github issue is still opened without any promising timeframes.</p>
<p>As per guide you sent and as per <a href="https://epsagon.com/how-to/streaming-eks-metrics-and-logs-to-cloudwatch/" rel="nofollow noreferrer">Streaming EKS Metrics and Logs to CloudWatch</a>,  if you configured everything correctly, you can find logs under “Container Insights” from the drop-down menu.</p>
<p>Logs you might want to check are</p>
<ul>
<li><strong>Control plane logs</strong> consist of scheduler logs, API server logs, and
audit logs.</li>
<li><strong>Data plane logs</strong> consist of kubelet and container runtime
engine logs.</li>
</ul>
<p>Can you please specify what exact logs you have in your cloudwatch control plane logs and what you already checked? Maybe that will help</p>
