easyMultiple Choice
CKS Practice Question: A DevOps engineer notices that a container's…
A DevOps engineer notices that a container's stdout logs are not appearing in the `kubectl logs` output. The container runs a legacy application that writes logs to a file inside the container. What is the most efficient way to capture these logs without modifying the application?
⚠ Common exam trap
CNCF often tests the sidecar logging pattern as the standard Kubernetes solution for capturing file-based logs, and the trap here is that candidates may incorrectly choose kubelet log rotation (Option A) thinking it applies to all container logs, when in fact it only applies to the container runtime's own stdout/stderr streams.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a sidecar container that reads the log file and outputs to stdout.
Deploying a sidecar container that tails the log file and writes to its own stdout is the most efficient, Kubernetes-native pattern for capturing logs from applications that write to files. The sidecar container shares the same Pod and volume, reads the log file (e.g., using `tail -F`), and outputs to stdout, which is then collected by `kubectl logs` and the cluster-level logging pipeline. This approach requires no modification to the legacy application and leverages the existing container runtime and kubelet log collection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the kubelet to rotate logs from the container's filesystem.
Why it's wrong here
Kubelet's log rotation is designed for the container runtime's stdout/stderr streams, not for arbitrary files written inside the container's filesystem. The kubelet interacts with the runtime to manage standard output and error, and it has no mechanism to read or rotate application-level files. Since your application writes to a file rather than stdout, kubelet rotation cannot surface or manage those logs.
- ✓
Add a sidecar container that reads the log file and outputs to stdout.
Why this is correct
This pattern adds a lightweight sidecar container that shares a volume with the main application, typically an emptyDir, where the log file resides. The sidecar tails the file and writes every new line to its own stdout, which kubectl logs reads. It gives you real-time file log streaming through the standard Kubernetes API without modifying the primary container or its image.
- ✗
Use `kubectl cp` to periodically copy logs from the container.
Why it's wrong here
kubectl cp performs a one-time tar-based copy of files from a container to the local machine, but it is a manual, pull-based operation that does not provide continuous log access. Running it periodically would introduce significant overhead and latency, and it still would not expose logs via kubectl logs or other standard Kubernetes logging mechanisms. Additionally, kubectl cp requires exec access to the container, making it fragile and ill-suited for production observability.
- ✗
Install a syslog daemon in the container to forward logs.
Why it's wrong here
Installing a syslog daemon means rebuilding the container image with additional binaries and configuration, which violates the principle of immutable infrastructure where images should be frozen after build. Syslog forwarding sends logs to a configurable remote destination, but that destination is not kubectl logs; you would need a separate collector, parser, and potentially a log aggregation service to view the logs. This approach adds operational complexity and resource consumption compared to a sidecar, making it an inefficient solution for simply reading file logs.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.