Where the answers are.
WHERE LOGS LIVE
Under var and log, traditionally as text files.
WHAT THE IMPORTANT ONES ARE
The general system log Authentication and access attempts The mail log Web server access and error logs Service-specific logs
WHAT journalctl DOES
Reads the systemd journal.
WHAT THE USEFUL OPTIONS ARE
Follow, showing new entries live Since a time For a specific unit Only errors and above
WHY FILTERING BY UNIT MATTERS
It removes everything unrelated, which is most of it.
WHAT TO DO WHEN INVESTIGATING
Establish the time the problem occurred, then look at that window.
WHY THE TIME FIRST
Logs are enormous, and searching without a window wastes effort.
WHAT TO LOOK FOR
Errors immediately before the symptom The first error, not the last
WHY THE FIRST
Later errors are frequently consequences of the first.
WHAT LOG ROTATION IS
Old logs compressed and eventually deleted.
WHY IT MATTERS
Logs fill disks, and a full disk breaks everything.
WHAT TO CHECK
That rotation is configured for anything writing large logs.
WHAT TO DO ABOUT A LOG GROWING RAPIDLY
Find what is writing to it before deleting it.
