Room 37

LOG ANALYSIS

The Signal Noise

Application logs hold the key to debugging. But there’s a lot of noise.
Parse through logs to find the hidden password.

📜 Mission Briefing

Apply noisy-app.yaml - a pod that generates 1000 log lines.
Most lines are noise. The password is hidden in a line containing ESCAPE_KEY.
Use kubectl logs with grep to find it.
The password is logparse.

Key Commands

Command	Purpose
`kubectl logs POD`	View pod logs
`kubectl logs POD -f`	Follow/stream logs
`kubectl logs POD --previous`	Logs from crashed container
`kubectl logs POD -c CONTAINER`	Specific container logs
`kubectl logs POD --since=1h`	Logs from last hour
`kubectl logs POD --tail=100`	Last 100 lines
`kubectl logs -l app=NAME`	Logs from all pods with label

Logging Patterns

# Basic log viewing
kubectl logs my-pod
kubectl logs my-pod -f              # Follow (stream)
kubectl logs my-pod --timestamps    # Add timestamps
kubectl logs my-pod --tail=50       # Last 50 lines
kubectl logs my-pod --since=5m      # Last 5 minutes
kubectl logs my-pod --since-time="2024-01-01T00:00:00Z"

# Multi-container pods
kubectl logs my-pod -c sidecar
kubectl logs my-pod --all-containers

# All pods in a deployment
kubectl logs deploy/my-app
kubectl logs -l app=my-app --all-containers

# Filtering with grep
kubectl logs my-pod | grep "ERROR"
kubectl logs my-pod | grep -c "WARNING"   # Count
kubectl logs my-pod | grep "ESCAPE_KEY"

# Log architecture in K8s:
# Container → stdout/stderr → kubelet → node filesystem
# /var/log/containers/<pod>_<ns>_<container>-<id>.log
# Collected by: Fluentd, Fluent Bit, Vector, Loki

Hints

Hint 1

kubectl apply -f noisy-app.yaml
kubectl logs noisy-app | grep ESCAPE_KEY

Hint 2

The line with ESCAPE_KEY contains the password value.

Hint 3

The password is logparse.

🔓 Unlock Room 38

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_38/README -out ../room_38/README.txt -pass pass:PASSWORD
cat ../room_38/README.txt