During a short outage window for a library catalog API, an engineer needs recent lines with wall-clock times rather than the entire container history. Which kubectl logs approach fits best?
Select an answer to reveal the explanation.
Short Explanation
Think of --tail as grabbing the last few pages of a notebook and --timestamps as writing the clock on each page. Together they shrink noise for a short incident window. That beats drowning in the whole log file.
Full Explanation
During a short library catalog API outage window, responders need a bounded, time-correlated view of application stdout rather than an unbounded dump of the entire container history. kubectl logs with --tail=<N> limits how many recent lines return, and --timestamps prefixes each line with a wall-clock stamp so engineers can align log lines with the incident interval, dashboards, and change tickets. Together those flags shrink noise and make chronology explicit—exactly what a brief civic outage triage needs when the catalog API is failing under load or after a rollout.
Piping kubectl get events -A and ignoring container logs fails conceptually because Events are Kubernetes control-plane notices (scheduling, probes, pulls), not the application’s request and error messages that usually explain an API outage. Setting imagePullPolicy: Always fails because pull policy only affects when images are fetched; it does not bound or timestamp existing logs, nor does it create useful empty logs for timing analysis. Enabling a ClusterRole that aggregates all namespace logs into one stream fails because RBAC grants API access; it does not turn kubectl logs into a durable, cluster-wide SIEM or automatically merge streams with timestamps for one incident window.
Exam caveat: --tail and --timestamps still read the kubelet’s retained log buffer for that container—they are not a long-term retention store, and multi-container Pods still need -c. Operational check: reproduce with kubectl logs deploy/library-catalog --tail=200 --timestamps (or the specific Pod), confirm stamps fall inside the outage window, and capture the snippet into the municipal incident timeline before the Pod restarts and older lines age out.