0 / 15 lessons — 0%
Lesson 07 / 15
Logs & journald
Something broke. The log almost always says why — the skill is knowing where to look. Modern systemd-based distros centralize most of it through journald.
journalctl # everything, oldest first journalctl -f # follow live, like tail -f journalctl -u nginx # just one service's logs journalctl -p err # only error-priority and worse journalctl --since "1 hour ago" journalctl -b # only logs since the current boot
Plenty of applications still log to plain files instead of (or alongside) the journal, mostly under /var/log:
| File | Contains |
|---|---|
/var/log/syslog (or /var/log/messages) | General system messages, distro-dependent name |
/var/log/auth.log (or /var/log/secure) | Login attempts, sudo usage, SSH activity |
/var/log/nginx/, /var/log/mysql/... | Application-specific logs, per-service directories |
tail -f /var/log/nginx/error.log # watch a plain log file live grep "Failed password" /var/log/auth.log # hunting for something specific
Logs that grow forever will eventually fill the disk. journald caps itself by default, but plain log files under /var/log usually rely on
logrotate to compress and delete old entries — check /etc/logrotate.d/ exists and covers anything that logs heavily.Try it yourselfRun
journalctl -p err -b on a real machine — every error-or-worse message since the last boot, in one command. It's usually the first thing worth checking on an unfamiliar box.