查看apiserver 审计日志：
grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="requestURI":")[^"]*' | sort | uniq -c | sort -rn | head -n 100
grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="username":")[^"]*' | sort | uniq -c | sort -rn | head -n 100
grep '"code":5' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="code":)\d+' | sort | uniq -c | sort
grep '"verb":"patch"' logs/audit-2023-01-04T10-52-55.847.log | grep -Po '(?<=system:node:)[\d\.]+' | sort | uniq -c | sort -rn | wc -l
grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="requestURI":")[^"]*' | sort | uniq -c | sort -rn | head -n 100
grep '"code":504' audit-2023-01-05T02-53-58.676.log | grep -Po '(?<="username":")[^"]*' | sort | uniq -c | sort -rn | head -n 100
grep '"verb":"patch"' logs/audit-2023-01-04T10-52-55.847.log | grep -Po '(?<=system:node:)[\d\.]+' | sort | uniq -c | sort -rn | wc -l标签：audit,code,grep,log,常用命令,k8s From： https://www.cnblogs.com/Direction-of-efforts/p/17901803.html