Logs & journalctl — Reading System Logs

journalctl                        # All logs (huge output)
journalctl -f                     # Follow live (like tail -f)
journalctl -n 50                  # Last 50 lines
journalctl -p err                 # Errors only
journalctl -u nginx               # Specific service logs
journalctl -u nginx --since today # Today's nginx logs
journalctl --since "2025-03-01"   # Since a specific date
journalctl --since "1 hour ago"   # Last hour
journalctl -b                     # Current boot only
journalctl -b -1                  # Previous boot
journalctl --disk-usage           # Space used by logs

journalctl -p warning          # Warning level and above
journalctl -p 0..3             # Emergency through errors only

# Common log locations
/var/log/syslog                # System log (Debian/Ubuntu)
/var/log/messages              # System log (RHEL/Fedora)
/var/log/auth.log              # Authentication attempts
/var/log/kern.log              # Kernel messages
/var/log/nginx/access.log      # Nginx access log
/var/log/nginx/error.log       # Nginx error log

# Monitor in real-time
tail -f /var/log/syslog
tail -f /var/log/auth.log

dmesg                          # All kernel ring buffer messages
dmesg | tail -20               # Most recent entries
dmesg -T                       # Human-readable timestamps
dmesg | grep -i usb            # USB-related messages
dmesg | grep -i error          # Kernel errors only