Linux Log Files Explained

# List all log files, sorted by modification time
ls -lht /var/log/

# Check total log disk usage
sudo du -sh /var/log/

# View the entire file (careful with large files!)
cat /var/log/syslog          # Debian/Ubuntu
cat /var/log/messages        # AlmaLinux/RHEL

# Page through a large log file
less /var/log/syslog

# View the last 50 lines
tail -n 50 /var/log/syslog

# Follow a log in real time (like a live stream)
tail -f /var/log/syslog

# Follow multiple files at once
tail -f /var/log/syslog /var/log/auth.log

# Find all SSH login attempts
grep "sshd" /var/log/auth.log         # Debian/Ubuntu
grep "sshd" /var/log/secure           # AlmaLinux/RHEL

# Find failed login attempts
grep "Failed password" /var/log/auth.log

# Case-insensitive search
grep -i "error" /var/log/syslog

# Show 3 lines before and after each match (context)
grep -B3 -A3 "error" /var/log/syslog

# Count occurrences
grep -c "Failed password" /var/log/auth.log

# Search across all log files
grep -r "Out of memory" /var/log/

# Search compressed/rotated logs
zgrep "error" /var/log/syslog.2.gz

# Find all entries from today (Feb 25)
grep "Feb 25" /var/log/syslog

# Find entries in a time range using awk
awk '/Feb 25 10:00/,/Feb 25 11:00/' /var/log/syslog

# Count errors per hour
grep "error" /var/log/syslog | awk '{print $1, $2, $3}' | cut -d: -f1 | sort | uniq -c

# Show all logs (newest at the bottom)
sudo journalctl

# Show logs in reverse order (newest first)
sudo journalctl -r

# Follow logs in real time
sudo journalctl -f

# Show only the last 100 entries
sudo journalctl -n 100

# Logs for a specific service
sudo journalctl -u nginx
sudo journalctl -u sshd
sudo journalctl -u mariadb

# Follow a specific service's logs in real time
sudo journalctl -u nginx -f

# Multiple services at once
sudo journalctl -u nginx -u php-fpm

# Logs since a specific date/time
sudo journalctl --since "2026-02-24 10:00"

# Logs from the last hour
sudo journalctl --since "1 hour ago"

# Logs between two times
sudo journalctl --since "2026-02-24" --until "2026-02-25"

# Logs from the current boot only
sudo journalctl -b

# Logs from the previous boot
sudo journalctl -b -1

# List all available boots
sudo journalctl --list-boots

# Show only errors and more severe
sudo journalctl -p err

# Show warnings and above
sudo journalctl -p warning

# Priority levels (0=most severe):
#   0 emerg   — System is unusable
#   1 alert   — Immediate action needed
#   2 crit    — Critical conditions
#   3 err     — Error conditions
#   4 warning — Warning conditions
#   5 notice  — Normal but significant
#   6 info    — Informational
#   7 debug   — Debug-level messages

# Combine priority with service and time
sudo journalctl -u nginx -p err --since "1 hour ago"

# Short (default) — one line per entry
sudo journalctl -u nginx -o short

# Verbose — all metadata fields
sudo journalctl -u nginx -o verbose

# JSON — machine-readable
sudo journalctl -u nginx -o json-pretty

# cat — message text only, no metadata
sudo journalctl -u nginx -o cat

# Kernel messages (equivalent to dmesg)
sudo journalctl -k

# Kernel messages from current boot
sudo journalctl -k -b

# Kernel errors only
sudo journalctl -k -p err

# Follow Nginx errors in real time
sudo tail -f /var/log/nginx/error.log

# Find 500 errors in access logs
grep '" 500 ' /var/log/nginx/access.log

# Top 10 IPs hitting your server
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10

# Find slow MySQL queries (if slow query log is enabled)
sudo tail -100 /var/log/mysql/slow-query.log

# Rotate logs weekly
weekly

# Keep 4 weeks of old logs
rotate 4

# Create new empty log files after rotation
create

# Compress old log files with gzip
compress

# Don't compress the most recently rotated file (for services that
# haven't yet reopened their log file handle)
delaycompress

# Include per-application configs
include /etc/logrotate.d

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        if [ -d /etc/nginx ]; then
            /usr/sbin/nginx -s reopen > /dev/null 2>&1 || true
        fi
    endscript
}

/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
    maxsize 100M
}

# Dry run — show what would happen without doing it
sudo logrotate -d /etc/logrotate.conf

# Force rotation now (useful for testing)
sudo logrotate -f /etc/logrotate.d/myapp

# Run logrotate verbosely
sudo logrotate -v /etc/logrotate.conf

# Check logrotate status (last rotation times)
cat /var/lib/logrotate/status

# Check current journal disk usage
sudo journalctl --disk-usage

# Remove journal entries older than 7 days
sudo journalctl --vacuum-time=7d

# Limit journal to 500MB
sudo journalctl --vacuum-size=500M

# Keep only the 5 most recent journal files
sudo journalctl --vacuum-files=5

[Journal]
# Maximum disk space the journal can use
SystemMaxUse=500M

# Always keep at least this much free
SystemKeepFree=1G

# Maximum time to keep entries
MaxRetentionSec=30day

# Maximum size of individual journal files
SystemMaxFileSize=50M

sudo systemctl restart systemd-journald

# Create the journal directory (enables persistence)
sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

# Verify — you should now see logs from previous boots
sudo journalctl --list-boots

# 1. Check for recent errors across all services
sudo journalctl -p err --since "1 hour ago"

# 2. Check if any services have failed
systemctl list-units --state=failed

# 3. Check disk usage (logs filling disk?)
df -h /var/log
sudo du -sh /var/log/*

# 4. Check for OOM kills
sudo dmesg | grep -i "oom|killed process"

# 5. Check auth failures (brute force?)
sudo journalctl -u sshd -p warning --since today | tail -20