EX280 Troubleshooting And Diagnostics — Timed 10 Questions

Question 1

An OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?

10 minute time limit — choose an answer to begin.

Accepted Answer

oc logs -n openshift-authentication deployment/oauth-openshift. The best method is to check the oauth-openshift deployment logs in the openshift-authentication namespace. These logs will contain errors related to OAuth metadata retrieval, such as failures to reach the OAuth server routes. This directly pinpoints the issue described.

Answer

oc get events -n openshift-config-managed

Answer

oc get clusteroperator authentication -o yaml

Answer

oc adm must-gather --image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...

Question 2

A cluster administrator suspects that an API rate-limiting issue is causing intermittent client timeouts. Which component logs should be inspected to confirm that clients are exceeding their API request limits?

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. The kube-apiserver logs on the control plane nodes should be inspected to confirm API rate-limiting issues. These logs contain entries about client requests exceeding limits, such as 'rate limit exceeded' messages. This directly confirms the suspected issue.

Answer

oc get events --all-namespaces

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc logs -n openshift-kube-apiserver-operator deployment/cluster-kube-apiserver-operator

Question 3

A developer reports that their pod is unable to start because it cannot mount a persistent volume claim (PVC). Where should the administrator look to diagnose volume attachment issues related to the CSI driver?

Accepted Answer

oc describe pvc my-pvc. `oc describe pvc my-pvc` is the correct first stop because the PVC's Events section surfaces the CSI driver's provisioning/attachment failures — including 'failed to provision volume', 'waiting for a volume to be created', or attach-detach controller errors that name the specific CSI driver and node. The PVC status conditions (Pending, Lost, or bound-but-unattached) plus the event stream give the administrator the exact failure reason without needing node-level access.

Answer

oc get events -n openshift-storage

Answer

oc debug node/worker-0

Answer

oc logs -n openshift-cluster-storage-operator deployment/csi-snapshot-controller-operator

Question 4

A pod in the 'production' namespace is crashing repeatedly due to a segmentation fault in the application binary. The administrator needs to inspect the file system of the crashing container without altering the deployment spec permanently. Which command is most appropriate?

Accepted Answer

oc debug pod/my-app-6b79f-abcde. The 'oc debug pod/my-app-6b79f-abcde' command creates a debug pod that copies the target pod's specification but overrides the command to start a shell, allowing the administrator to inspect the file system and troubleshoot without modifying the deployment. This is the standard OpenShift troubleshooting approach for crashing containers.

Answer

oc logs pod/my-app-6b79f-abcde --previous

Answer

oc rsh deployment/my-app

Answer

oc exec -it pod/my-app-6b79f-abcde -- /bin/sh

Question 5

A node in an OpenShift cluster goes into 'NotReady' status. The administrator uses 'oc debug node/<node-name>' to inspect the node's root filesystem. Where are the host's system logs mounted inside the debug chroot environment?

Accepted Answer

/host/var/log. When using 'oc debug node/<node-name>', the host's root filesystem is mounted at /host inside the debug pod, and the host's system logs are accessible at /host/var/log. This is the standard path for inspecting node logs in OpenShift.

Answer

/rootfs/var/log

Answer

/mnt/host/log

Answer

/var/log

Question 6

An OpenShift cluster experiences severe etcd latency spikes, causing leader elections to fail. Which metric or diagnostic tool should be used to inspect etcd peer round-trip times directly from the command line within the cluster?

Accepted Answer

oc rsh -n openshift-etcd pod/etcd-<node-name> etcdctl endpoint health. The etcdctl binary is embedded in the etcd static pods running in the openshift-etcd namespace, and 'etcdctl endpoint health' queries each peer's /health endpoint, returning the round-trip latency to that member. Running it via 'oc rsh' inside the etcd pod gives direct, low-level visibility into peer RTT without relying on aggregated Prometheus metrics. This is the canonical CLI method for diagnosing etcd leader-election failures caused by slow peer communication.

Answer

oc adm inspect etcd

Answer

oc adm diagnostics etcd-latency

Answer

oc get etcd -o yaml

Question 7

An administrator wants to stream logs from all pods belonging to a specific Deployment named 'web-frontend' in real-time. Which command achieves this?

Accepted Answer

oc logs deployment/web-frontend -f. oc logs supports targeting a Deployment directly via the resource type, streaming logs from all associated pods.

Answer

oc watch deployment/web-frontend

Answer

oc logs pods -l app=web-frontend

Answer

oc rsh deployment/web-frontend

Question 8

An administrator needs to check the cluster events across all namespaces sorted by timestamp to identify recent infrastructure warnings. Which command should they use?

Accepted Answer

oc get events --sort-by='.metadata.creationTimestamp'. The correct command is `oc get events --sort-by='.metadata.creationTimestamp'`. This uses the standard `oc get` verb to list all events in the current namespace (or all namespaces if `--all-namespaces` is added), and the `--sort-by` flag sorts the output by the creation timestamp of each event. This directly addresses the requirement to view events sorted by timestamp to identify recent warnings.

Answer

oc adm events --all

Answer

oc show events --recent

Answer

oc cluster-events

Question 9

An administrator needs to tail the logs of all pods with the label 'tier=frontend' across the current namespace. Which command should be used?

Accepted Answer

oc logs -l tier=frontend. The `oc logs` command supports the `-l` (or `--selector`) flag to aggregate logs from all pods matching a label selector in the current namespace. `oc logs -l tier=frontend` streams the logs of every pod with the label `tier=frontend`, which is exactly what the administrator needs. This is the documented OpenShift/Kubernetes pattern for multi-pod log tailing without listing pods individually.

Answer

oc watch logs tier=frontend

Answer

oc logs pods --selector=tier=frontend -f

Answer

oc tail -l tier=frontend

Question 10

An administrator observes that a specific node has high CPU utilization and wants to identify which processes or containers are consuming the most resources on that host directly. Which command-line tool executed inside an oc debug session on the node is best suited for interactive process monitoring?

Accepted Answer

oc debug node/ -- chroot /host top. oc debug node/ -- chroot /host top launches a debug pod on the node, chroots into the host filesystem, and runs top to show live per-process CPU/memory usage on the node itself. This gives interactive, real-time visibility into host-level processes and containers, which is what the question asks for.

Answer

oc exec node/<node-name> -- ps aux

Answer

oc adm monitor node

Answer

oc adm top node --use-protocol-buffers