// Module included in the following assemblies:
//
// * authentication/understanding-and-managing-pod-security-admission.adoc

:_mod-docs-content-type: PROCEDURE
[id="security-context-constraints-psa-alert-eval_{context}"]
= Identifying pod security violations

[role="_abstract"]
To identify which workloads are causing pod security violations, you can review the Kubernetes API server audit logs by using the `must-gather` tool.

The `PodSecurityViolation` alert does not provide details on which workloads are causing pod security violations.

.Prerequisites

* You have installed `jq`.
* You have access to the cluster as a user with the `cluster-admin` role.

.Procedure

. To gather the audit logs, enter the following command:
+
[source,terminal]
----
$ oc adm must-gather -- /usr/bin/gather_audit_logs
----

. To output the affected workload details, enter the following command:
+
[source,terminal]
----
$ zgrep -h pod-security.kubernetes.io/audit-violations must-gather.local.<archive_id>/<image_digest_id>/audit_logs/kube-apiserver/*log.gz \
  | jq -r 'select((.annotations["pod-security.kubernetes.io/audit-violations"] != null) and (.objectRef.resource=="pods")) | .objectRef.namespace + " " + .objectRef.name' \
  | sort | uniq -c
----
+
Replace `<archive_id>` and `<image_digest_id>` with the actual path names.
+
.Example output
[source,text]
----
1 test-namespace my-pod
----
