Huawei Cloud CCE Log Analyzer#

Overview#

Query and analyze Kubernetes Pod stdout logs, CCE LogConfig-collected application logs, and Huawei Cloud LTS log streams for CCE workloads.

Architecture: scripts/huawei-cloud.py dispatcher → cce.py (Pod stdout) / cce_app_logs.py (LogConfig discovery & app log stream matching) / lts.py (LTS group/stream/query) → K8s API / CCE OpenAPI / LTS API

Related Skills:

• huawei-cloud-cce-pod-failure-diagnoser - Pod startup, scheduling, crash-loop diagnosis
• huawei-cloud-cce-workload-failure-diagnoser - Deployment/StatefulSet rollout issues
• huawei-cloud-cce-node-failure-diagnoser - Node NotReady, disk pressure, network issues
• huawei-cloud-cce-kubernetes-event-analyzer - Kubernetes Warning events and patterns

Capabilities:

• Query Kubernetes Pod stdout/stderr and previous container logs
• List, create, and delete CCE LogConfig collection rules
• Discover application LogConfig policies and map to LTS log groups/streams
• Query CCE Kubernetes audit logs for Pod deletion and workload change events
• Query application logs from LTS by time range, keywords, or recent hours
• Analyze application logs for abnormal keywords, HTTP errors, incident windows, recovery time, and abnormal ratios

Typical Use Cases:

• "Check my Pod logs for crash errors"
• "Find the LTS stream for my application"
• "Query recent application logs for ERROR keywords"
• "Analyze logs in the last hour for abnormalities"
• "Who deleted this Pod? Check audit logs"
• "Create a LogConfig to collect my workload stdout"
• "Remove this LogConfig collection rule"
• "Query container file logs from /var/log/*.log"

Prerequisites#

1. Python Runtime#

• Python 3.8+ installed
• Run python3 --version to verify

2. Huawei Cloud Credentials#

• Valid Huawei Cloud credentials (AK/SK mode)

• Security Rules:

  • 🚫 Never expose AK/SK values in code, conversation, or output
  • 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
  • ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
  • ✅ Prefer IAM users over root account for cloud operations

Configuration Method (Environment Variables):

bash

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

3. IAM Permission Requirements#

API ActionPermissionPurposecce:cluster:getGet clusterView cluster detailscce:logConfig:listList LogConfigQuery LogConfig collection rulescce:logConfig:createCreate LogConfigCreate log collection rulescce:logConfig:deleteDelete LogConfigRemove log collection ruleslts:logs:listList LTS logsQuery log streams and log recordslts:groups:listList LTS groupsQuery log group information

Security Constraints#

Dangerous Operation Confirmation Mechanism#

This skill enforces a preview-then-confirm mechanism for all mutating operations.

OperationRisk LevelDescriptionhuawei_create_cce_logconfig🟡 MediumCreates a LogConfig collection rule; preview by default, create with confirm=true``huawei_delete_cce_logconfig🟠 HighDeletes a LogConfig collection rule; preview by default, delete with confirm=true

Process: Call without confirm=true → inspect preview output → user confirms → call with confirm=true

Credential & Data Security#

• Never expose AK/SK, tokens, kubeconfig certificates, or full sensitive log payloads in summaries
• Redact tokens, passwords, cookies, authorization headers, and personally identifiable data from log output
• Prefer time-bounded queries — if no time range provided, use recent logs with small limits

Scope Boundaries#

• This skill is read-only by default for log queries and LogConfig inspection
• Creating/deleting LogConfig is allowed only through the dedicated tools with confirm=true
• Do not modify workloads, LTS groups/streams, or other cloud resources
• If logs indicate failures, hand off to the relevant diagnosis skill with evidence, do not remediate here

Scenario Routing#

User IntentTool(s)Reference DocumentQuery Pod stdout/stderr logshuawei_get_pod_logsreferences/workflow.mdQuery previous terminated container logshuawei_get_pod_logs (previous=true)references/workflow.mdList cluster LogConfig ruleshuawei_get_cce_logconfigsreferences/workflow.mdCreate LogConfig for stdout/file collectionhuawei_create_cce_logconfigreferences/workflow.mdDelete a LogConfig rulehuawei_delete_cce_logconfigreferences/workflow.mdDiscover app LTS stream mappinghuawei_get_application_logconfigsreferences/workflow.mdQuery audit logs for Pod deletionhuawei_query_cce_audit_logsreferences/workflow.mdQuery audit logs for workload changeshuawei_query_cce_audit_logsreferences/workflow.mdQuery recent application logshuawei_query_application_recent_logsreferences/workflow.mdQuery application logs in time windowhuawei_query_application_logsreferences/workflow.mdAnalyze logs for abnormalitieshuawei_analyze_application_logsreferences/workflow.mdRisk constraints & guardrails—references/risk-rules.mdOutput schema reference—references/output-schema.md

Core Commands#

1. Kubernetes Pod Stdout Logs#

bash

# Query recent stdout from a Pod
python3 scripts/huawei-cloud.py huawei_get_pod_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  pod_name=<pod-name> \
  tail_lines=200

# Query previous terminated container logs
python3 scripts/huawei-cloud.py huawei_get_pod_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  pod_name=<pod-name> \
  container=<container-name> \
  previous=true \
  tail_lines=200

2. LogConfig Discovery & Management#

bash

# List all LogConfig resources in a cluster
python3 scripts/huawei-cloud.py huawei_get_cce_logconfigs \
  region=cn-north-4 \
  cluster_id=<cluster-id>

# Discover app LTS stream from LogConfig
python3 scripts/huawei-cloud.py huawei_get_application_logconfigs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name>

# Preview then create a workload stdout LogConfig
python3 scripts/huawei-cloud.py huawei_create_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  source_type=container_stdout \
  workload_namespace=default \
  workload_name=<workload-name> \
  workload_kind=Deployment \
  log_group_id=<lts-group-id> \
  log_stream_id=<lts-stream-id>
# Then call again with confirm=true after user confirms

# Preview then create a container file LogConfig
python3 scripts/huawei-cloud.py huawei_create_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  source_type=container_file \
  workload_namespace=default \
  workload_name=<workload-name> \
  workload_kind=Deployment \
  container=<container-name> \
  log_path=/var/log \
  file_pattern="*.log" \
  log_group_id=<lts-group-id> \
  log_stream_id=<lts-stream-id>
# Then call again with confirm=true after user confirms

# Preview then delete a LogConfig
python3 scripts/huawei-cloud.py huawei_delete_cce_logconfig \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  logconfig_name=<policy-name> \
  logconfig_namespace=kube-system
# Then call again with confirm=true after user confirms

3. CCE Audit Logs#

bash

# Query Pod deletion audit events
python3 scripts/huawei-cloud.py huawei_query_cce_audit_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  audit_type=pod_delete \
  namespace=default \
  hours=6 \
  log_group_id=<audit-lts-group-id> \
  log_stream_id=<audit-lts-stream-id>

# Query workload change audit events
python3 scripts/huawei-cloud.py huawei_query_cce_audit_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  audit_type=workload_change \
  namespace=default \
  start_time="2026-05-30 10:00:00" \
  end_time="2026-05-30 11:00:00"

4. Application Log Query & Analysis#

bash

# Query recent application logs from a specific LogConfig policy
python3 scripts/huawei-cloud.py huawei_query_application_recent_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name> \
  logconfig_name=<policy-name> \
  hours=1 \
  keywords=ERROR \
  auto_paginate=true \
  max_pages=5 \
  limit=100

# Analyze an application log window for abnormal logs
python3 scripts/huawei-cloud.py huawei_analyze_application_logs \
  region=cn-north-4 \
  cluster_id=<cluster-id> \
  namespace=default \
  app_name=<workload-name> \
  logconfig_name=<policy-name> \
  start_time="2026-05-30 10:00:00" \
  end_time="2026-05-30 11:00:00" \
  auto_paginate=true \
  max_pages=5 \
  limit=1000

Parameter Reference#

Common Parameters#

ParameterRequiredDescriptionDefaultregionYesHuawei Cloud region IDcn-north-4``cluster_idYesCCE cluster ID—namespaceMost toolsKubernetes namespacedefault

Pod Log Parameters#

ParameterToolRequiredDescriptionConstraintspod_name``huawei_get_pod_logsYesPod nameMust reference existing Podcontainer``huawei_get_pod_logsNoContainer nameRequired for multi-container Podsprevious``huawei_get_pod_logsNoPrevious terminated containertrue/ false``tail_lines``huawei_get_pod_logsNoNumber of recent linesRecommended 100-500

LogConfig Parameters#

ParameterToolRequiredDescriptionConstraintslogconfig_namecreate/deleteYesLogConfig policy nameUnique within namespacesource_typecreateYesCollection source typecontainer_stdout or container_file``workload_namecreateYesTarget workload nameMust reference existing workloadworkload_kindcreateYesWorkload typeDeployment, StatefulSet, DaemonSet``workload_namespacecreateYesWorkload namespace—containercreate (file)NoContainer nameRequired for container_filelog_pathcreate (file)NoLog file directory pathRequired when source_type=container_filefile_patterncreate (file)NoFile name patterne.g. *.log``log_group_idcreateYesLTS log group IDMust reference existing LTS grouplog_stream_idcreateYesLTS log stream IDMust reference existing LTS streamconfirmcreate/deleteNoExecute confirmationPreview without it; true to executelogconfig_namespacedeleteYesLogConfig namespace—

Audit Log Parameters#

ParameterToolRequiredDescriptionConstraintsaudit_type``huawei_query_cce_audit_logsNoKeyword presetpod_delete or workload_change``hoursauditNoRecent hours windowUsed when no start_time/end_timestart_timeauditNoStart timeYYYY-MM-DD HH:MM:SS formatend_timeauditNoEnd timeYYYY-MM-DD HH:MM:SS formatlog_group_idauditRecommendedAudit LTS group IDAuto-discovered if omittedlog_stream_idauditRecommendedAudit LTS stream IDAuto-discovered if omitted

Application Log Parameters#

ParameterToolRequiredDescriptionConstraintsapp_nameapp log toolsYesWorkload nameMust reference existing workloadlogconfig_nameapp log toolsNoSpecific LogConfig policySelects from matched streamspolicy_nameapp log toolsNoSpecific policy nameAlternative to logconfig_namekeywordsapp log toolsNoKeyword filterLTS keyword searchhoursrecent logsNoRecent hours windowDefault 1start_timetime-range logsNoStart timeYYYY-MM-DD HH:MM:SS formatend_timetime-range logsNoEnd timeYYYY-MM-DD HH:MM:SS formatauto_paginateapp log toolsNoEnable paginationtrue/ false``max_pagesapp log toolsNoMax pages to fetchCaps total work when paginatinglimitapp log toolsNoPer-page sizeRecommended 100-1000

Common Region IDs#

Region NameRegion IDNorth China - Beijing 4cn-north-4North China - Beijing 1cn-north-1East China - Shanghai 1cn-east-3East China - Shanghai 2cn-east-2South China - Guangzhoucn-south-1South China - Shenzhencn-south-4Southwest China - Guiyang 1cn-southwest-2Asia Pacific - Bangkokap-southeast-2Asia Pacific - Singaporeap-southeast-1Asia Pacific - Hong Kongap-southeast-3Europe - Pariseu-west-0

Best Practices#

1. Narrowest scope first — use Pod stdout when the user names a Pod, application LTS logs when they name a workload
2. Recent windows before broad searches — prefer hours=1 or tail_lines=100-500 before full historical queries
3. Discover before querying — call huawei_get_application_logconfigs first to find the right LogConfig policy, then pass logconfig_name or policy_name to query tools
4. Preview before mutating — always call create/delete LogConfig without confirm=true first; only call with confirm=true after user reviews the preview
5. Use auto_paginate for multi-page results — set auto_paginate=true with max_pages to cap total work; limit controls per-page size
6. Redact sensitive data — never include tokens, passwords, cookies, authorization headers, or PII in log summaries
7. Group repeated patterns — when summarizing logs, group repeated lines by pattern and include counts
8. Hand off for remediation — if logs indicate Pod startup, image pull, scheduling, node, or network failures, recommend the corresponding diagnosis skill with exact evidence

Common Pitfalls#

PitfallSymptomQuick FixMissing LogConfig for appNo LTS stream foundCreate LogConfig with huawei_create_cce_logconfigWrong LogConfig policyLogs from wrong streamUse huawei_get_application_logconfigs to discover correct policykeywords filter skews analysis ratiosAbnormal ratio too high/lowDo not set keywords unless user explicitly wants keyword-scoped ratiosAudit type misunderstoodAudit results too broad/narrowaudit_type is keyword preset only; pod_delete adds delete+pods, workload_change adds workload-related keywordsNo confirm=true on create/deletePreview-only, no actual changeCall again with confirm=true after reviewing previewLarge time window without paginationPartial or slow resultsUse auto_paginate=true with max_pages and reasonable limitPrevious container log not found"previous" flag on running containerUse previous=true only when container has restarted; check Pod status firstAK/SK exposed in outputCredential leakRedact all credentials; summarize patterns instead of raw values

Notes#

• LogConfig tools are the only mutation path — creating and deleting LogConfig resources is only supported through huawei_create_cce_logconfig and huawei_delete_cce_logconfig with confirm=true
• Audit logs are keyword-based — huawei_query_cce_audit_logs uses pure keyword search over LTS audit content; all convenience parameters ( pod_name, resource_name, workload_name, namespace, user, verb, resource, status_code) are converted into keywords, not parsed-field filters
• stdout vs container_file — use source_type=container_stdout for Pod standard output, source_type=container_file for application file logs collected from paths like /var/log/*.log
• Analysis tool denominator — huawei_analyze_application_logs calculates ratios over the queried log set; adding keywords changes the denominator to only matched logs, so avoid it unless explicitly requested
• Analysis returns — abnormal ratio, log rates, first/last abnormal time, observed recovery time, incident windows, top patterns, status-code distribution, and samples

Output Format#

All tools return JSON with structured log data, analysis results, or LogConfig previews. See references/output-schema.md for detailed response schemas.

Verification#

1. Run environment check script
2. Query a known Pod log with huawei_get_recent_logs
3. Verify the LogConfig preview/confirm workflow
4. Confirm read-only behavior for query operations

Reference Documents#

DocumentDescriptionworkflow.mdDetailed workflow for Pod stdout, application LTS logs, LogConfig management, and audit queriesrisk-rules.mdRisk constraints, security rules, and scope boundariesoutput-schema.mdLog query and analysis output schema reference