aks

Query the AKSKubeEvents table in AKSccplogs filtered by your ccpNamespace for reasons like NodeNotReady and RegisteredNode, then check ClusterAutoscaler logs for provisioning failures. The skill's node-troubleshooting guide provides the exact KQL templates and analysis steps.

First run the ManagedClusterSnapshot query in AKSprod to get the ccpNamespace value, then use it to filter tables like KubeAudit, Etcd, and ClusterAutoscaler in the AKSccplogs database. Most tables filter on the namespace or cluster_id column.

You need read access to four Kusto databases: AKSprod for cluster configuration and operations, AKSccplogs for control plane logs and audit events, AKSinfra for underlay infrastructure, and AKSmetrics for pod performance metrics.

Column names differ across tables, such as namespace versus ccpNamespace for cluster filtering, and size versus nodeCount on AgentPoolSnapshot. Verify schemas against the local table-schema JSON files or the TABLE_SCHEMA_REFERENCE guide before writing queries.

Yes, query the KubeAudit table or ControlPlaneEvents with category kube-audit in AKSccplogs, filtering by verb like delete or patch and parsing the user and objectRef fields. The audit-logs guide includes templates for pod status changes and API server client analysis.

AKSinfra only tracks Microsoft-owned underlay infrastructure nodes, not customer worker nodes in the MC_ resource group. For customer node issues, query AKSccplogs for control plane events or use kubectl and Container Insights instead.