<p>On k8s, where audit logs of starting/stopping pods or containers are stored?</p>

<p>On k8s, we often store logs in hostpath /var/log, and let one agent mount this path and be charged of flush these logfiles. I wonder if there is one file in hostpath, store the audit logs of starting/stopping pods or containers.</p>

Tianqiu Huang
<p>It is not enabled by default, but you can do it by <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">Audit</a>, which is a part of <code>kube-apiserver</code> functionality.</p>

<p>You should create a policy for Audit which will describe what you want to catch and then you have 2 options how to store them - push somewhere using WebHook or write to files on a Master node.</p>

<p>To enable writing to a file, you should set a CLI flag for <code>kube-apiserver</code>: <code>--audit-log-path</code> with a path for log files. </p>

<p>Also, I highly recommend you to set a size limit for that files by <code>--audit-log-maxsize</code> because they can be really big.</p>
