// Module included in the following assemblies:
//
// * support/gathering-cluster-data.adoc
// * support/troubleshooting/verifying-node-health.adoc

:_mod-docs-content-type: PROCEDURE
[id="querying-cluster-node-journal-logs_{context}"]
= Querying cluster node journal logs

[role="_abstract"]
You can gather `journald` unit logs and other logs within `/var/log` on individual cluster nodes.

.Prerequisites

* You have access to the cluster as a user with the `cluster-admin` role.
ifdef::openshift-dedicated[]
+
[NOTE]
====
In {product-title} deployments, customers who are not using the Customer Cloud Subscription (CCS) model cannot use the `oc adm node-logs` command as it requires `cluster-admin` privileges.
====
+
endif::openshift-dedicated[]
* You have installed the OpenShift CLI (`oc`).
ifndef::openshift-rosa,openshift-rosa-hcp,openshift-dedicated[]
* Your API service is still functional.
* You have SSH access to your hosts.
endif::openshift-rosa,openshift-rosa-hcp,openshift-dedicated[]

.Procedure

ifndef::openshift-rosa-hcp[]
. Query `kubelet` `journald` unit logs from {product-title} cluster nodes. The following example queries control plane nodes only:
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
* Query `kubelet` `journald` unit logs from {product-title} cluster nodes. The following example queries worker nodes only:
endif::openshift-rosa-hcp[]
+
ifndef::openshift-rosa-hcp[]
[source,terminal]
----
$ oc adm node-logs --role=master -u kubelet  <1>
----
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
[source,terminal]
----
$ oc adm node-logs --role=worker -u kubelet
----
endif::openshift-rosa-hcp[]
`kubelet`:: Replace as appropriate to query other unit logs.

ifndef::openshift-rosa-hcp[]
. Collect logs from specific subdirectories under `/var/log/` on cluster nodes.
+
.. Retrieve a list of logs contained within a `/var/log/` subdirectory. The following example lists files in `/var/log/openshift-apiserver/` on all control plane nodes:
+
[source,terminal]
----
$ oc adm node-logs --role=master --path=openshift-apiserver
----
+
.. Inspect a specific log within a `/var/log/` subdirectory. The following example outputs `/var/log/openshift-apiserver/audit.log` contents from all control plane nodes:
+
[source,terminal]
----
$ oc adm node-logs --role=master --path=openshift-apiserver/audit.log
----
endif::openshift-rosa-hcp[]
ifndef::openshift-rosa,openshift-rosa-hcp,openshift-dedicated[]
+
.. If the API is not functional, review the logs on each node using SSH instead. The following example tails `/var/log/openshift-apiserver/audit.log`:
+
[source,terminal]
----
$ ssh core@<master-node>.<cluster_name>.<base_domain> sudo tail -f /var/log/openshift-apiserver/audit.log
----
+
[NOTE]
====
{product-title} {product-version} cluster nodes running {op-system-first} are immutable and rely on Operators to apply cluster changes. Accessing cluster nodes by using SSH is not recommended. Before attempting to collect diagnostic data over SSH, review whether the data collected by running `oc adm must gather` and other `oc` commands is sufficient instead. However, if the {product-title} API is not available, or the kubelet is not properly functioning on the target node, `oc` operations will be impacted. In such situations, it is possible to access nodes using `ssh core@<node>.<cluster_name>.<base_domain>`.
====
endif::openshift-rosa,openshift-rosa-hcp,openshift-dedicated[]
