yaisme / Docker Log Review

sudo lsof +L1 | awk 'NR==1{print "COMMAND", "FD", "SIZE_MB", "NAME"} NR>1{print $1, $4, $7, $10}' | numfmt --to-unit=1M --field=3 --format="%.2f MB" --header | sort -k3 -nr | column -t

#!/bin/bash TMPFILE=$(mktemp) # Get all deleted Docker logs that are still open sudo lsof +L1 | awk ' NR == 1 { next } $NF ~ /\(deleted\)$/ && $0 ~ /\/var\/lib\/docker\/containers\/.*-json\.log/ { print } ' | while read -r line; do PROCESS=$(echo "$line" | awk '{print $1}') SIZE=$(echo "$line" | awk '{print $(NF-4)}') FILE=$(echo "$line" | awk '{for (i=9; i<=NF; i++) printf $i " "; print ""}' | sed 's/ (deleted)//') # Skip if SIZE is not numeric if ! [[ "$SIZE" =~ ^[0-9]+$ ]]; then continue fi SIZE_MB=$(awk -v s="$SIZE" 'BEGIN {printf "%.2f", s/1048576}') CONTAINER_ID=$(basename "$(dirname "$FILE")") # Get container metadata INFO=$(docker ps -a --no-trunc --filter "id=$CONTAINER_ID" --format "{{.ID}}|{{.Image}}|{{.Command}}|{{.RunningFor}}|{{.Names}}") if [[ -z "$INFO" ]]; then ID_SHORT="N/A"; IMAGE="N/A"; CMD="N/A"; CREATED="N/A"; NAMES="N/A" else IFS='|' read -r ID IMAGE_RAW CMD CREATED NAMES <<< "$INFO" ID_SHORT=$(echo "$ID" | cut -c1-12) IMAGE=$(echo "$IMAGE_RAW" | sed 's|.*/||' | cut -d':' -f1) fi echo -e "$SIZE_MB MB\t$PROCESS\t$ID_SHORT\t$CREATED\t$NAMES" >> "$TMPFILE" done # Output #echo -e "Proc\tImage\tSize\tContainer ID\tImage\tCommand\tCreated\tNames" sort -nk1 "$TMPFILE" rm -f "$TMPFILE"

#!/usr/bin/env bash # Trim all Docker/K8S container logs to last 1000 lines KEEP=1000 # Look for all docker json logs for f in /var/lib/docker/containers/*/*-json.log; do if [ -f "$f" ]; then echo "Trimming $f ..." tmp=$(mktemp) tail -n $KEEP "$f" > "$tmp" && cat "$tmp" > "$f" rm -f "$tmp" fi done # Also check kubelet-managed logs (optional) for f in /var/log/containers/*.log /var/log/pods/*/*/*.log; do if [ -f "$f" ]; then echo "Trimming $f ..." tmp=$(mktemp) tail -n $KEEP "$f" > "$tmp" && cat "$tmp" > "$f" rm -f "$tmp" fi done echo "Done."

#!/bin/bash echo -e "SIZE\tPOD_NAME\tNAMESPACE\tCONTAINER_NAME\tLOG_PATH" # Step 1: Find all container logs and sort by size sudo find /var/lib/docker/containers/ -type f -name "*.log" | while read -r logfile; do # echo -e "$logfile" # Get file size size=$(sudo du -h "$logfile" | awk '{print $1}') #echo -e "$size\t$logfile" # Get container ID from filename or path container_id=$(basename "$logfile" | cut -d'-' -f1) #echo -e "$size\t$container_id" # Use docker inspect to get Kubernetes labels #pod_name=$(docker inspect "$container_id" 2>/dev/null | grep '"io.kubernetes.pod.name"' | cut -d':' -f2 | tr -d ' ",') #namespace=$(docker inspect "$container_id" 2>/dev/null | grep '"io.kubernetes.pod.namespace"' | cut -d':' -f2 | tr -d ' ",') container_name=$(docker inspect "$container_id" 2>/dev/null | grep '"io.kubernetes.container.name"' | cut -d':' -f2 | tr -d ' ",') # Print results #echo -e "$size\t$pod_name\t$namespace\t$container_name\t$logfile" echo -e "$size\t$container_name" done | sort -h