Event types — Normal, Warning, and the involved objects

Kubernetes events have two types (Normal, Warning) and many reasons. The events are associated with Kubernetes objects. This lesson walks the event types, the reasons, the messages, and the involved objects.

The event types

The event types:

flowchart LR
    A[Event] --> B[Normal]
    A --> C[Warning]
    B --> D[Scheduled]
    B --> E[Pulled]
    B --> F[Started]
    C --> G[FailedScheduling]
    C --> H[BackOff]
    C --> I[Unhealthy]

The types are the categorization.

The Normal events

The Normal events:

Scheduled: Pod was scheduled to a node
Pulled: Container image was pulled
Created: Container was created
Started: Container was started
Killing: Container was killed
Preempting: Pod was preempted
NodeNotReady: Node is not ready
NodeReady: Node is ready

The Normal events are the lifecycle.

The Warning events

The Warning events:

FailedScheduling: Pod could not be scheduled
BackOff: Container failed to start, backoff
Unhealthy: Probe failed
FailedMount: Volume could not be mounted
FailedCreate: Could not create resource
FailedDelete: Could not delete resource
InvalidDiskCapacity: Disk capacity is invalid

The Warning events are the failures.

The event reasons

The event reasons:

# All events
kubectl get events -A

# Filter by type
kubectl get events --field-selector type=Warning

# Filter by reason
kubectl get events --field-selector reason=FailedScheduling

The reasons are the filters.

The event messages

The event messages:

Normal Event:
  Reason: Scheduled
  Message: Successfully assigned default/nginx-1-abc to worker-1

Warning Event:
  Reason: FailedScheduling
  Message: 0/5 nodes are available: 5 Insufficient cpu.

The messages describe the event in detail.

The involved objects

The involved objects:

involvedObject:
  kind: Pod
  name: nginx-1-abc
  namespace: default
  uid: 1a2b3c4d-5e6f-7g8h-9i0j-k1l2m3n4o5p6

The involved objects identify the Kubernetes object.

The event sources

The event sources:

source:
  component: default-scheduler
  host: worker-1

The sources identify the emitter.

The event timestamps

The event timestamps:

firstTimestamp: 2026-08-16T10:00:00Z
lastTimestamp: 2026-08-16T10:00:00Z
count: 1

The timestamps track the event lifecycle.

The event selector

The event selector:

# Field selector
kubectl get events --field-selector type=Warning,reason=FailedScheduling

# Label selector
kubectl get events -l app=nginx

# Namespace selector
kubectl get events -n default

The selectors are the filters.

The event watching

The event watching:

kubectl get events -A --watch

The watch flag shows the events in real time.

The production patterns

The production patterns:

flowchart LR
    A[Normal events] --> B[OK]
    B --> C[Ignore]
    D[Warning events] --> E[Alert]
    E --> F[Investigate]
    F --> G[Resolve]
    G --> H[Document]

The pattern is the production flow.

The cross-course references

• The Observability course covers the events.
• The Kubelet course covers the runtime events.
• The Scheduler course covers the scheduling events.

Quiz

Production discipline

• Identify the warning events. The failures.
• Use the field selector. The targeted query.
• Use the event reasons. The granular filters.
• Watch the events. The real-time stream.
• Document the events. The investigation.
• Test the events. The event recording.

The event types are the cluster’s change log. Operating it well is the categories, the reasons, the involved objects, and the production patterns.