Forum Discussion

deep-learner's avatar
deep-learner
Occasional Reader
Sep 05, 2025

AKS Log Analytics Workspace records the log for only 3 hours problem

Dear AKS service provider,

My AKS Log Analytics Workspace only records from 13:30 UTC to 16:30 UTC container logs each day in the "ContainerLogV2". I wonder what config causes it. How to diagnose and revive to whole day logs? How to troubleshoot?

I am sure the container is working properly and has a full log for the day. 

 

1 Reply

Sort By
  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Sep 06, 2025

    I am not the provider, please allow me to share some ideas:

     

    1. Inspect Data Collection Configuration

    • Go to your AKS cluster in the Azure Portal.
    • Navigate to Monitoring > Insights > Data Collection Settings.
    • Ensure ContainerLogV2 is enabled and not scoped to specific hours or namespaces.

    2. Check Agent Health

    kubectl get pods -n kube-system | grep omsagent

     

    kubectl logs <omsagent-pod-name> -n kube-system

    Look for errors or restarts that might explain the gap.

    3. Review Workspace Query Scope

    In Log Analytics, run:

    ContainerLogV2
| where TimeGenerated > ago(24h)
| summarize count() by bin(TimeGenerated, 1h)

    This will show you hourly log volumes and help pinpoint gaps.

    4. Validate Cluster Resource Usage

    If your nodes are under memory or CPU pressure, logging agents may fail intermittently:

    kubectl top nodes

    and

    kubectl top pods --all-namespaces

     

Resources