1# General AKS Investigation & Diagnostics
2 
3## "What happened in my cluster?"
4 
5When a user asks a broad question like "what happened in my AKS cluster?" or "check my AKS status", follow this systematic flow:
6 
71. Cluster health
82. Recent events
93. Node status
104. Unhealthy pods
115. All pods overview
126. System pods health
137. Activity log
14 
15```bash
16az aks show -g <rg> -n <cluster> --query "provisioningState"
17kubectl get events -A --sort-by='.lastTimestamp' | head -40
18kubectl get nodes -o wide
19kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded
20kubectl get pods -A -o wide
21kubectl get pods -n kube-system -o wide
22az monitor activity-log list -g <rg> --max-events 20 -o table
23```
24 
25---
26 
27## AKS CLI Tools
28 
29```bash
30# Get cluster credentials (required before kubectl commands)
31az aks get-credentials -g <rg> -n <cluster>
32 
33# View node pools
34az aks nodepool list -g <rg> --cluster-name <cluster> -o table
35```
36 
37### AppLens (MCP) for AKS
38 
39For AI-powered diagnostics:
40 
41```text
42mcp_azure_mcp_applens
43  intent: "diagnose AKS cluster issues"
44  command: "diagnose"
45  parameters:
46    resourceId: "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ContainerService/managedClusters/<cluster>"
47```
48 
49> 💡 **Tip:** AppLens automatically detects common issues and provides remediation recommendations using the cluster resource ID.
50 
51---
52 
53## Best Practices
54 
551. **Start with kubectl get/describe** - Always check basic status first
562. **Check events** - `kubectl get events -A` reveals recent issues
573. **Use systematic isolation** - Pod -> Node -> Cluster -> Network
584. **Document changes** - Note what you tried and what worked
595. **Escalate when needed** - For control plane issues, contact Azure support
60