Finding the relevant line among thousands.
WATCHING LIVE
tail -f on a log file shows lines as they are written. Reproduce the problem while watching, and the cause usually appears.
FILTERING
grep finds matching lines. Combine with tail to watch for specific patterns, or with cat to search history.
Use -i to ignore case, -v to exclude matches, and -c to count rather than display.
COUNTING AND SORTING
Extracting a field, sorting, and counting unique values identifies the top offenders: which addresses make the most requests, which URLs return the most errors, which user agents dominate.
This is how you identify bot traffic in an access log in under a minute.
TIME RANGES
Logs are chronological, so filtering by timestamp narrows to the period of interest.
JOURNALCTL
For systemd services, journalctl provides filtered access to service logs, including by unit and by time range. More convenient than finding log files for services that log there.
THE PRACTICAL SKILL
Knowing how to answer "what was happening at 14:30" in thirty seconds rather than scrolling.
