Overview

This article describes how to collect Windows event logs from Azure Kubernetes Service (AKS) pods. 

Retrieving Windows event logs

To retrieve Windows event logs from AKS pod via Azure Command-Line Interface (CLI):

1. To switch to the required subscription, run the following command:

   az account set --subscription <subscription ID>

2. Then run:

   az aks get-credentials --resource-group <Resource Group Name> --name <AKS name> --admin

3. To get Powershell running in the pod and run PowerShell commands there, run:

   kubectl -n <pod namespace> exec pod/<Pod Name> -it -- powershell.exe

4. To retrieve the application logs, run the following command inside PowerShell:

   Get-EventLog -LogName application

5. To retrieve the system logs, run the following command inside PowerShell:

   Get-EventLog -LogName system

Note: The default PowerShell table formatting might truncate the results. To prevent truncation, consider appending the Get-EventLog commands with | Format-Table -AutoSize -Wrap. 
For example:

Get-EventLog -LogName application | Format-Table -AutoSize -Wrap

For alternative methods, refer to this article: https://stackoverflow.com/questions/1443569/powershell-get-eventlog-message-column-is-too-short.