Where the answers are.
WHAT LOGS EXIST
Web server access and error logs System logs Authentication logs Application logs Mail logs
WHAT TO LOOK AT FIRST
The error log for the affected service, around the time of the problem.
FOR WEBSITE ERRORS
The web server error log names the file and line.
FOR FAILED LOGINS
The authentication log shows attempts. A large number is normal and expected; a successful one you did not make is not.
FOR MAIL PROBLEMS
Mail logs show whether a message was accepted, rejected or deferred, and why.
WHAT TO WATCH FOR ROUTINELY
Repeated errors Unusual access patterns Successful logins at odd times Disk filling with logs
LOG ROTATION
Logs grow. Rotation archives and deletes old ones.
Without it, logs fill the disk. That is a common cause of sudden failure.
WHAT TO KEEP
Enough history to investigate an incident. Weeks, at least.
