System Logs

# All logs (from oldest)
journalctl

# Logs in real time (like tail -f)
journalctl -f

# Last N messages
journalctl -n 50

# Log of a specific service
journalctl -u nginx
journalctl -u mariadb
journalctl -u sshd
journalctl -u php8.2-fpm

# Log of a service in real time
journalctl -u nginx -f

# Log of current boot
journalctl -b

# Log of previous boot (useful to understand why the server restarted)
journalctl -b -1

# Only errors and critical messages
journalctl -p err
journalctl -p err -b    # Only errors from current boot

# Logs in a time interval
journalctl --since "2024-03-01" --until "2024-03-28"
journalctl --since "1 hour ago"
journalctl --since "today"

journalctl -u nginx | grep "error"
journalctl -u sshd | grep "Failed"
journalctl | grep -i "oom\|killed"

# Read a file in real time
tail -f /var/log/nginx/error.log

# Last 100 lines
tail -100 /var/log/nginx/access.log

# Search for a word in logs
grep "error" /var/log/nginx/error.log
grep -i "refused\|denied" /var/log/auth.log

# How many times an IP appears in the access log
grep "1.2.3.4" /var/log/nginx/access.log | wc -l

# IPs making the most requests (possible attack)
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

# Last reboot
last reboot | head -5

# OOM killer (process terminated due to lack of RAM)
journalctl -b -1 | grep -i "oom\|killed process\|out of memory"
dmesg | grep -i "oom"

# Kernel panic or crash
journalctl -b -1 -p 0..3

# Current uptime
uptime

# Failed login attempts
grep "Failed password" /var/log/auth.log | tail -20

# IPs attempting brute force
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -10

# Successful logins
grep "Accepted" /var/log/auth.log | tail -20

# Last accesses
last | head -20

# How much space journald logs use
journalctl --disk-usage

# Delete logs older than 30 days
journalctl --vacuum-time=30d

# Limit logs to 500MB total
journalctl --vacuum-size=500M

# Configure limits permanently
nano /etc/systemd/journald.conf

[Journal]
SystemMaxUse=500M
MaxRetentionSec=1month

systemctl restart systemd-journald

# Test the configuration
logrotate --debug /etc/logrotate.conf

# Force manual rotation
logrotate -f /etc/logrotate.conf

# Nginx configuration (example)
cat /etc/logrotate.d/nginx