Reading your server logs
Find errors, follow live logs, and use logs to solve problems instead of guessing.
Logs are the difference between guessing and knowing. Here is where yours are and how to read them.
Two kinds of logs
systemd journal — service output, boot messages, kernel messages. Query with
journalctl.Application logs — files the app writes (often
/var/log/), including web server access/error logs.
The journal
journalctl -u nginx # everything for one service
journalctl -u nginx -n 100 # last 100 lines
journalctl -u nginx -f # follow live (Ctrl-C to stop)
journalctl -u nginx --since "1 hour ago"
journalctl -u nginx --since today --priority=err # errors only
journalctl -b -1 # previous boot (great after a crash)
journalctl -xe # recent errors with explanationsWeb server logs
# nginx
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log
# what is hitting you, and how often
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head
# the URLs being requested most
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head
# 5xx errors with the request that caused them
awk '$9 ~ /^5/ {print $7, $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | headApache equivalents live in /var/log/apache2/ with the same shape.
Reading a log line
A typical nginx combined line:
203.0.113.10 - - [13/Oct/2026:10:22:31 +0000] "GET /blog/hello HTTP/1.1" 200 5123 "https://example.com/" "Mozilla/5.0 ..."Client IP · timestamp · request · status · bytes · referrer · user agent. The status code is usually the first thing to scan.
Log rotation
Left alone, logs fill the disk. Most systems rotate daily via logrotate:
ls /etc/logrotate.d/
logrotate -d /etc/logrotate.conf # dry run, shows what it would doIf disk usage steps down each night on your graphs, rotation is working; if it only climbs, it is not.
Logging hygiene
Never log secrets — passwords, tokens, full card numbers.
Log enough to debug, not so much that the disk fills.
Centralise if you have many services — Grafana Loki is a good self-hosted option.
Keep logs long enough to investigate the incidents you actually have (weeks, usually).
Related reading