Huawei Cloud CCE Log Analyzer

Overview

Query and analyze Kubernetes Pod stdout logs, CCE LogConfig-collected application logs, and Huawei Cloud LTS log streams for CCE workloads.

Architecture: scripts/huawei-cloud.py dispatcher → cce.py (Pod stdout) / cce_app_logs.py (LogConfig discovery & app log stream matching) / lts.py (LTS group/stream/query) → K8s API / CCE OpenAPI / LTS API

Related Skills:

• huawei-cloud-cce-pod-failure-diagnoser - Pod startup, scheduling, crash-loop diagnosis
• huawei-cloud-cce-workload-failure-diagnoser - Deployment/StatefulSet rollout issues
• huawei-cloud-cce-node-failure-diagnoser - Node NotReady, disk pressure, network issues
• huawei-cloud-cce-kubernetes-event-analyzer - Kubernetes Warning events and patterns

Capabilities:

• Query Kubernetes Pod stdout/stderr and previous container logs
• List, create, and delete CCE LogConfig collection rules
• Discover application LogConfig policies and map to LTS log groups/streams
• Query CCE Kubernetes audit logs for Pod deletion and workload change events
• Query application logs from LTS by time range, keywords, or recent hours
• Analyze application logs for abnormal keywords, HTTP errors, incident windows, recovery time, and abnormal ratios

Typical Use Cases:

• "Check my Pod logs for crash errors"
• "Find the LTS stream for my application"
• "Query recent application logs for ERROR keywords"
• "Analyze logs in the last hour for abnormalities"
• "Who deleted this Pod? Check audit logs"
• "Create a LogConfig to collect my workload stdout"
• "Remove this LogConfig collection rule"
• "Query container file logs from /var/log/*.log"

Prerequisites

1. Python Runtime

• Python 3.8+ installed
• Run python3 --version to verify

2. Huawei Cloud Credentials

• Valid Huawei Cloud credentials (AK/SK mode)
• Security Rules:
  • 🚫 Never expose AK/SK values in code, conversation, or output
  • 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
  • ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
  • ✅ Prefer IAM users over root account for cloud operations

Configuration Method (Environment Variables):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

3. IAM Permission Requirements

Security Constraints

Dangerous Operation Confirmation Mechanism

This skill enforces a preview-then-confirm mechanism for all mutating operations.

Process: Call without confirm=true → inspect preview output → user confirms → call with confirm=true

Credential & Data Security

• Never expose AK/SK, tokens, kubeconfig certificates, or full sensitive log payloads in summaries
• Redact tokens, passwords, cookies, authorization headers, and personally identifiable data from log output
• Prefer time-bounded queries — if no time range provided, use recent logs with small limits

Scope Boundaries

• This skill is read-only by default for log queries and LogConfig inspection
• Creating/deleting LogConfig is allowed only through the dedicated tools with confirm=true
• Do not modify workloads, LTS groups/streams, or other cloud resources
• If logs indicate failures, hand off to the relevant diagnosis skill with evidence, do not remediate here

Scenario Routing

Core Commands

1. Kubernetes Pod Stdout Logs

# Query recent stdout from a Pod
python3 scripts/huawei-cloud.py huawei_get_pod_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  pod_name=<pod-name> \
  tail_lines=200

# Query previous terminated container logs
python3 scripts/huawei-cloud.py huawei_get_pod_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  pod_name=<pod-name> \
  container=<container-name> \
  previous=true \
  tail_lines=200

2. LogConfig Discovery & Management

# List all LogConfig resources in a cluster
python3 scripts/huawei-cloud.py huawei_get_cce_logconfigs \
  region=cn-north-4 \
  cluster_id=<cluster-id>

# Discover app LTS stream from LogConfig
python3 scripts/huawei-cloud.py huawei_get_application_logconfigs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name>

# Preview then create a workload stdout LogConfig
python3 scripts/huawei-cloud.py huawei_create_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  source_type=container_stdout \
  workload_namespace=default \
  workload_name=<workload-name> \
  workload_kind=Deployment \
  log_group_id=<lts-group-id> \
  log_stream_id=<lts-stream-id>
# Then call again with confirm=true after user confirms

# Preview then create a container file LogConfig
python3 scripts/huawei-cloud.py huawei_create_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  source_type=container_file \
  workload_namespace=default \
  workload_name=<workload-name> \
  workload_kind=Deployment \
  container=<container-name> \
  log_path=/var/log \
  file_pattern="*.log" \
  log_group_id=<lts-group-id> \
  log_stream_id=<lts-stream-id>
# Then call again with confirm=true after user confirms

# Preview then delete a LogConfig
python3 scripts/huawei-cloud.py huawei_delete_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  logconfig_namespace=kube-system
# Then call again with confirm=true after user confirms

3. CCE Audit Logs

# Query Pod deletion audit events
python3 scripts/huawei-cloud.py huawei_query_cce_audit_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  audit_type=pod_delete \
  namespace=default \
  hours=6 \
  log_group_id=<audit-lts-group-id> \
  log_stream_id=<audit-lts-stream-id>

# Query workload change audit events
python3 scripts/huawei-cloud.py huawei_query_cce_audit_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  audit_type=workload_change \
  namespace=default \
  start_time="2026-05-30 10:00:00" \
  end_time="2026-05-30 11:00:00"

4. Application Log Query & Analysis

# Query recent application logs from a specific LogConfig policy
python3 scripts/huawei-cloud.py huawei_query_application_recent_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name> \
  logconfig_name=<policy-name> \
  hours=1 \
  keywords=ERROR \
  auto_paginate=true \
  max_pages=5 \
  limit=100

# Analyze an application log window for abnormal logs
python3 scripts/huawei-cloud.py huawei_analyze_application_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name> \
  logconfig_name=<policy-name> \
  start_time="2026-05-30 10:00:00" \
  end_time="2026-05-30 11:00:00" \
  auto_paginate=true \
  max_pages=5 \
  limit=1000

Parameter Reference

Common Parameters

Pod Log Parameters

LogConfig Parameters

Audit Log Parameters

Application Log Parameters

Common Region IDs

Best Practices

1. Narrowest scope first — use Pod stdout when the user names a Pod, application LTS logs when they name a workload
2. Recent windows before broad searches — prefer hours=1 or tail_lines=100-500 before full historical queries
3. Discover before querying — call huawei_get_application_logconfigs first to find the right LogConfig policy, then pass logconfig_name or policy_name to query tools
4. Preview before mutating — always call create/delete LogConfig without confirm=true first; only call with confirm=true after user reviews the preview
5. Use auto_paginate for multi-page results — set auto_paginate=true with max_pages to cap total work; limit controls per-page size
6. Redact sensitive data — never include tokens, passwords, cookies, authorization headers, or PII in log summaries
7. Group repeated patterns — when summarizing logs, group repeated lines by pattern and include counts
8. Hand off for remediation — if logs indicate Pod startup, image pull, scheduling, node, or network failures, recommend the corresponding diagnosis skill with exact evidence

Common Pitfalls

Notes

• LogConfig tools are the only mutation path — creating and deleting LogConfig resources is only supported through huawei_create_cce_logconfig and huawei_delete_cce_logconfig with confirm=true
• Audit logs are keyword-based — huawei_query_cce_audit_logs uses pure keyword search over LTS audit content; all convenience parameters (pod_name, resource_name, workload_name, namespace, user, verb, resource, status_code) are converted into keywords, not parsed-field filters
• stdout vs container_file — use source_type=container_stdout for Pod standard output, source_type=container_file for application file logs collected from paths like /var/log/*.log
• Analysis tool denominator — huawei_analyze_application_logs calculates ratios over the queried log set; adding keywords changes the denominator to only matched logs, so avoid it unless explicitly requested
• Analysis returns — abnormal ratio, log rates, first/last abnormal time, observed recovery time, incident windows, top patterns, status-code distribution, and samples

Output Format

All tools return JSON with structured log data, analysis results, or LogConfig previews. See references/output-schema.md for detailed response schemas.

Verification

1. Run environment check script
2. Query a known Pod log with huawei_get_recent_logs
3. Verify the LogConfig preview/confirm workflow
4. Confirm read-only behavior for query operations

Reference Documents