# Kubernetes Event Explorer

> Paste kubectl events and get a timeline, reason taxonomy and likely root causes per workload. Paste `kubectl get events -A -o json` or the default `kubectl get events` table. Events are grouped by involved object and inferred workload (Pod → ReplicaSet → Deployment), each reason is classified (rollout, crash loop, probes, image pulls, scheduling, volumes, OOM, node pressure…), and evidence-based root-cause hypotheses explain what probably happened and what to check next.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://kuberneteseventexplorer.usefulweb.site/ (interactive tool at https://kuberneteseventexplorer.usefulweb.site/tool)
- JSON API: POST https://kuberneteseventexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://kuberneteseventexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://kuberneteseventexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://kuberneteseventexplorer.usefulweb.site/mcp - tool `kubernetes_event_explorer`

## Inputs
- text (textarea): kubectl events output - Output of `kubectl get events -A -o json` (best: exact timestamps) or the plain `kubectl get events -A` table including the header line. events.k8s.io/v1 JSON also works.
- file (file): Or upload the file - Read in memory as UTF-8 text and not stored. Max 5 MiB.
- namespace (text): Only this namespace (optional)
- warningsOnly (boolean): Only show Warning events in the timeline
- capturedAt (datetime): Table output captured at (UTC, optional) - Only for the text table: relative ages like "5m" are counted back from this time. Default: now.

## Method
- JSON events: involvedObject/regarding, reason, message, type, count/series.count, firstTimestamp/lastTimestamp/eventTime are read as documented for core/v1 and events.k8s.io/v1 Events.
- Table output: columns are located from the header line; relative ages (e.g. "3m (x7 over 11m)") are converted to absolute times counted back from capturedAt (default: the analysis time), and the "xN" repeat count is used as the occurrence count.
- Reasons are mapped to categories using the reason strings emitted by kubelet, scheduler, controllers and node-problem-detector; ambiguous reasons are refined by message (BackOff restarting vs pulling image; Unhealthy liveness vs readiness; Failed ErrImagePull vs CreateContainerConfigError).
- Pods are linked to Deployments via ScalingReplicaSet/SuccessfulCreate messages, then by the <deployment>-<rs-hash>-<pod-hash> naming convention.
- Root-cause rules combine signals per workload (e.g. liveness failures + back-off → probe-induced restarts; back-off alone → app exits; FailedScheduling message → resources/taints/affinity/PVC).