How to read and manage logs in Linux

When something goes wrong, the answer is almost always in the logs. Here is how to find and read them.

Service logs (systemd)

journalctl -u nginx            # a service's logs
journalctl -u nginx -f         # live
journalctl -u nginx --since "1 hour ago"

Classic log files

/var/log/syslog        # the system
/var/log/auth.log      # authentication (SSH)
/var/log/nginx/        # nginx

Search efficiently

grep "error" /var/log/nginx/error.log
tail -f /var/log/nginx/access.log

Kernel logs

dmesg | tail

Tips

• Check auth.log for suspicious login attempts, then harden with fail2ban.
• Logs take up space; configure rotation, see log rotation.
• For multiple servers, use centralized logging.