Finding what went wrong.
WHERE THEY ARE
Error and access logs are available in your home directory under logs, and through cPanel > Metrics > Errors and Raw Access.
Application logs live wherever the application puts them, commonly in a storage or logs directory.
WATCHING LIVE
tail -f on the error log, then reproduce the problem in a browser. The error appears as it happens, which is the fastest diagnosis available.
FILTERING
grep finds matching lines: a specific error, a specific IP address, a specific URL.
Combining tail with grep watches for a specific pattern live.
ANALYSING ACCESS LOGS
Extracting the address field, sorting and counting identifies which addresses make the most requests. This finds bot traffic in seconds.
The same technique on the URL field shows which pages are being hit hardest.
WHAT TO LOOK FOR
Repeated 500 errors, indicating application failures A sudden increase in requests from one source 404s in a pattern, indicating a scanner probing for vulnerabilities PHP fatal errors naming a file and line
