How to collect logs for support

Quick answer: Collect logs from the exact time window of the problem, include timestamps with your timezone, and send text, not screenshots of text. The four core sources are journalctl (system), the web server error log, dmesg (kernel/OOM) and the auth log — a focused excerpt from each beats megabytes of everything.

Overview

Tickets with the right logs get solved in one reply instead of five. This guide shows how to pull the relevant slice of each log so support (or you) can see what actually happened at the moment of failure.

Before you start

• The approximate time of the incident (as precise as you can) and SSH access.

Step-by-step guide

1. System log for the incident window:

   sudo journalctl --since '2026-07-16 14:00' --until '2026-07-16 14:30' -p warning

   Add -u nginx (or another unit) to focus on one service.
2. Web server errors around the failure:

   sudo grep ' 2026/07/16 14:' /var/log/nginx/error.log | tail -100

3. Kernel events (OOM kills, disk errors, crashes):

   sudo dmesg -T | tail -100

4. Authentication history if access is involved:

   sudo tail -200 /var/log/auth.log

   (see reading auth logs for interpretation).
5. Package it readably:

   sudo journalctl -b -p err > /root/incident-$(date +%F).txt

   Attach the file to the ticket, or paste inside code formatting — never as a photo.
6. State your timezone next to every timestamp — "14:07 EEST" is diagnosable, "around 2 pm" is not.

Common issues

• Logs already rotated: check /var/log/*.1 and .gz siblings (zgrep searches them directly).
• Screenshots of terminals: unreadable and unsearchable — copy the text.
• Whole-disk log dumps: slower to analyze than a focused window; narrow first.
• Journal missing old boots: persistent journaling may be off; logs before the last boot may only exist in file logs.

When to contact support

Attach your collected excerpts to the first message of the ticket, together with the items from what to include in a support ticket — that combination usually gets a substantive first reply.

Frequently asked questions

Which logs matter most for a typical incident?

Four sources cover most cases: journalctl for system events, the web server error log, dmesg for kernel and OOM messages, and the auth log when access or security is involved.

Why should I send text instead of screenshots?

Text can be searched, compared against known issues and quoted in replies. Screenshots of terminals lose detail, cannot be grepped and slow the whole investigation down noticeably.

Related articles

• What information to include in a support ticket
• How to check system logs
• How to read auth logs

Need a hand? Contact Cloud2Y support →