k8s 常用命令

查看apiserver 审计日志：

grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="requestURI":")[^"]*' | sort | uniq -c | sort -rn | head -n 100

grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="username":")[^"]*' | sort | uniq -c | sort -rn | head -n 100

grep '"code":5' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="code":)\d+' | sort | uniq -c | sort

grep '"verb":"patch"' logs/audit-2023-01-04T10-52-55.847.log | grep -Po '(?<=system:node:)[\d\.]+' | sort | uniq -c | sort -rn | wc -l

grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="requestURI":")[^"]*' | sort | uniq -c | sort -rn | head -n 100

grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="username":")[^"]*' | sort | uniq -c | sort -rn | head -n 100

grep '"verb":"patch"' logs/audit-2023-01-04T10-52-55.847.log | grep -Po '(?<=system:node:)[\d\.]+' | sort | uniq -c | sort -rn | wc -l


grep '"code":409' audit.log |grep -o '"verb":"[^"]*"'|sort | uniq -c | sort -nr