Quick answer: On systemd distros, journalctl is the master log: journalctl -u nginx -f follows a service live, journalctl --since "1 hour ago" narrows by time. Classic files live in /var/log — auth.log/secure for logins, web server logs under /var/log/nginx.
Overview
Logs are the first place to look when anything misbehaves: failed logins, crashed services, full disks, kernel events. Knowing five commands covers 95% of everyday debugging.
Before you start
- SSH access; most logs need root/sudo to read.
Step-by-step guide
- Service logs via journald:
journalctl -u nginx --since today journalctl -u nginx -f # follow live journalctl -p err -b # errors since boot - Authentication and security events:
# Debian family sudo tail -f /var/log/auth.log # RHEL family sudo tail -f /var/log/secure - Kernel and hardware messages:
sudo dmesg -T | tail -50 - Web server logs:
sudo tail -f /var/log/nginx/access.log /var/log/nginx/error.log - Search across a log:
sudo grep -i "failed password" /var/log/auth.log | tail -20
Common issues
- Journal eats disk: cap it —
sudo journalctl --vacuum-size=200M, or setSystemMaxUse=in/etc/systemd/journald.conf. - Log full of failed SSH logins: that's the internet's background noise — mitigate with Fail2ban and key-only auth.
- Logs missing after reboot: enable persistent journal:
sudo mkdir -p /var/log/journal && sudo systemctl restart systemd-journald.
When to contact support
If logs show hardware errors (disk I/O errors, memory faults in dmesg) on a Cloud2Y server, open a ticket with the exact lines — we will check the platform.
Frequently asked questions
Where do I see why a service crashed?
Run "journalctl -u servicename --since today" for that unit's log, or "journalctl -p err -b" to list every error since boot on any systemd-based distribution.
Why is my log full of failed SSH logins?
Internet-wide bots probe every public IP around the clock. Switch to SSH keys, disable password login and add Fail2ban — the noise then becomes harmless.
How do I stop journald from filling the disk?
Cap it with "journalctl --vacuum-size=200M" for an immediate cleanup, and set SystemMaxUse=200M in /etc/systemd/journald.conf for a permanent limit.
Related articles
Need a hand? Contact Cloud2Y support →
