Which datatypes should I prioritize when log monitoring Azure Kubernetes Service clusters?

Here are the datatypes you should prioritize when log monitoring Azure Kubernetes Service (AKS) clusters:

• AKS-audit logs hold information about all Kubernetes API requests, including create, update, delete, and list requests. They are the most critical logs to monitor, as they can help you identify unauthorized access and other security threats.


• AKS-audit-admin logs contain information about all administrative API requests, such as creating and deleting users and roles. This set of logs is less critical than AKS-audit logs, but it can still be helpful for troubleshooting and auditing.


• Container logs hold information about the containers running in your AKS cluster, so they help troubleshoot issues with individual containers.


• Node logs contain information about the nodes in your AKS cluster and can help troubleshoot issues with the nodes themselves.

If you are limited on resources, you can prioritize AKS-audit logs over AKS-audit-admin logs. However, monitoring both logs is vital to get a complete picture of activity in your AKS cluster.