CRI Container Log — Partial Lines and Two Streams (log)
The CRI log format Kubernetes nodes actually write: an RFC 3339 nanosecond timestamp, a stream name, and an F or P tag marking whether the line is full or a partial continuation. One long message is split across several P lines that must be rejoined before parsing.
2026-03-17T09:14:32.850000000Z stdout F starting checkout-api 1.14.2
2026-03-17T09:14:32.970000000Z stderr F warning: TLS verification disabled for psp.example.net
2026-03-17T09:14:33.150000000Z stdout P request context: k0=v0 k1=v1 k2=v2 k3=v3 k4=v4 k5=v5 k6=v6 k7=v7 k8=v8 k9=v9 k10=v10 k11=v
2026-03-17T09:14:33.150090000Z stdout P 11 k12=v12 k13=v13 k14=v14 k15=v15 k16=v16 k17=v17 k18=v18 k19=v19 k20=v20 k21=v21 k22=v22
2026-03-17T09:14:33.150180000Z stdout P k23=v23 k24=v24 k25=v25 k26=v26 k27=v27 k28=v28 k29=v29 k30=v30 k31=v31 k32=v32 k33=v33 k
2026-03-17T09:14:33.150270000Z stdout F 34=v34 k35=v35 k36=v36 k37=v37 k38=v38 k39=v39
2026-03-17T09:14:33.750000000Z stdout F order accepted ord-2026-0317-004182
2026-03-17T09:14:34.050000000Z stderr F panic: reserve: sku SKU-88213 not found
Specifications
- Lines
- 8
- Format
- CRI (containerd/CRI-O)
- Fields
- RFC3339Nano stream F|P message
- Partial Lines
- 3
- Streams
- stdout, stderr
- Reassembled Messages
- 5
- Reassembled Message Chars
- 316
Testing contract
Expected to pass- Scenario
- Read the file and reassemble partial lines into complete messages.
- Expected result
- The P-tagged fragments rejoin into one 316-character message so the file yields 5 logical messages, and stdout and stderr stay distinguishable after reassembly.
What is a .log file?
LOG files are plain-text records of events emitted by software, typically one entry per line with a timestamp, severity, and message. There is no single standard, so formats range from unstructured text to structured JSON lines. They are central to debugging, monitoring, and auditing.
How to use this file
Use an example LOG file to test log parsers, timestamp and severity extraction, line-oriented streaming, and ingestion into monitoring or analysis pipelines.
How to use this file for testing
“CRI Container Log — Partial Lines and Two Streams (log)” is a deterministic Novus Examples fixture for Observability, Log parsing, Config parsing. Structured and plain-text telemetry with known timestamps, levels, request identifiers, and error states for testing log ingestion, correlation, dashboards, and alert pipelines.
Documented properties for this file: CRI (containerd/CRI-O). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
Telemetry fixtures use fixed trace IDs, span IDs, and timestamps so ingestion is reproducible run to run. Point your collector, parser, or query layer at the file and assert the documented span tree, metric families, or severity mix; service and host names are invented.
Code examples
grep -i error cri-containerd-partial-lines.log | head
awk '{print $1, $2, $NF}' cri-containerd-partial-lines.log | headRelated files
- log.NET Exception with an Inner Exception Chain (log)A .NET exception whose inner exception is introduced by the ---> marker and closed by End of inner exception stack trace, wrapped in pipe-delimited log lines. Error groupers that key on the outermost message alone merge two genuinely different faults here.
- jsonlEnvoy-Style Proxy Access Log — JSON Lines (jsonl)Forty service-mesh proxy access records with the fields that make mesh debugging possible: response_flags distinguishing an upstream failure from an overflow, upstream_service_time against total duration, upstream host and cluster, and a request ID for correlation.
- logGo Panic with Full Goroutine Dump (log)A Go panic followed by the runtime's full goroutine dump — four goroutines with their wait states, two-line frames and a created by attribution, separated by blank lines. Blank-line separation defeats multi-line rules that treat an empty line as the end of an event.
- jsonlKubernetes Audit Log — Six Events with an RBAC Denial (jsonl)Six Kubernetes audit events at two audit levels, including one 403 whose authorization annotations record the forbid decision and its reason. The shape a cluster-audit alert or compliance report reads, with every user and service account invented.
- jsonOTLP Logs — Export Document with Severity and Trace Correlation (json)An OTLP logs export across two resources: five records spanning DEBUG to FATAL with both severityNumber and severityText, separate event and observed timestamps, trace and span correlation, and one record whose body is a full multi-line Python traceback.
- logRust Panic with Numbered Backtrace (log)A Rust panic surrounded by ordinary tracing output: the panic location with line and column, a six-frame numbered backtrace where every frame spans two lines, and the RUST_BACKTRACE note. Frame numbering and the deep indent are what a generic stack parser gets wrong here.
Generated by generation/observability.py. Free for any use, no attribution required — license.