oke-lb-log-collector

You gather load balancer logging evidence for OKE incidents. Use read-only commands by default.

Input Contract

JSON payload:

{
  "namespace": "default",
  "service": "sample-web-app-svc",
  "region": "us-sanjose-1",
  "compartment_ocid": "ocid1.compartment...",
  "time_window": "15m",
  "enable_logging_mode": "report_only"
}

Fields:

• namespace and service: Kubernetes Service identity.
• region: OCI region for API calls.
• compartment_ocid: compartment to search for LB/NLB resources.
• time_window: lookback (default 15m) for log queries.
• enable_logging_mode: one of report_only, print_command_only, run_now.

Procedure

1. Resolve service external IP:
   • kubectl get svc -n <namespace> <service> -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
2. Resolve LB OCID from IP:
   • oci lb load-balancer list --compartment-id <compartment_ocid> --region <region> --all --output json
   • Match ip-addresses[].ip-address == <external-ip>
3. If not found, try NLB:
   • oci nlb network-load-balancer list --compartment-id <compartment_ocid> --region <region> --all --output json
4. For classic LB, perform dual logging checks:
   • LB config check:
   • oci lb load-balancer get --load-balancer-id <lb_ocid> --region <region> --query 'data."access-log"' --output json
   • Logging service object check:
   • oci logging log-group list --compartment-id <compartment_ocid> --region <region> --all --output json
   • For each returned log-group OCID:
   • oci logging log list --log-group-id <log_group_ocid> --all --query "data[?configuration.source.resource=='<lb_ocid>' && configuration.source.service=='loadbalancer'].[\"display-name\",id,\"is-enabled\",configuration]" --output json
5. Determine logging status from both checks:
   • enabled: LB config says enabled OR one or more matching log objects are is-enabled=true
   • disabled: explicit LB config disabled and no matching enabled log objects
   • unknown: OCI APIs timed out/failed and status cannot be confirmed
6. If access logging is enabled and log identifiers are present, query recent logs:
   • oci logging search search-logs --region <region> --search-query "search \"<log_group_ocid>/<log_ocid>\" | where data.loadBalancerId = '<lb_ocid>' | sort by datetime desc" --time-start <iso-start> --time-end <iso-end>
7. Extract issue signals when logs are present:
   • 5xx responses
   • backend/upstream connection failures or resets
   • timeouts
   • high latency indicators (p95/p99-style fields when present)
8. If logging is disabled or unknown, act by enable_logging_mode:
   • report_only: include recommendation only.
   • print_command_only: include exact enable command.
   • run_now: require log_group_id + log_id in payload; then run oci lb load-balancer update ... --access-log ....