Linux Log Files

Also Known As

TL;DR

Explanation

Key log locations: /var/log/syslog or /var/log/messages (system events), /var/log/auth.log (authentication), /var/log/nginx/ (web server), /var/log/php/ (PHP errors), /var/log/mysql/ (database). journald stores logs in binary format — use journalctl to query. logrotate manages log rotation: compresses old logs, deletes aged logs, and signals services to reopen log files. Essential commands: tail -f (live follow), grep -i error, awk for field extraction, zcat/zgrep for compressed rotated logs.

Common Misconception

Why It Matters

Common Mistakes

• PHP error_log pointing to a file without logrotate config — grows to gigabytes over months.
• Not configuring postrotate in logrotate to signal PHP-FPM to reopen logs — continues writing to the renamed file.
• Grepping uncompressed current log instead of all rotated logs — misses historical events.
• Not knowing journalctl --since 'yesterday' for time-filtered system logs.

Code Examples

# No logrotate for PHP app — log grows unbounded:
; php.ini:
error_log = /var/log/php/app.log
; 6 months later: app.log = 47GB
; Server disk: 100% full
; All services crash

# /etc/logrotate.d/php-app:
/var/log/php/app.log {
    daily
    rotate 14         # Keep 14 days
    compress          # gzip old logs
    delaycompress     # Keep yesterday uncompressed for tail
    missingok
    notifempty
    create 0640 www-data adm
    postrotate
        # Signal PHP-FPM to reopen log file:
        /bin/kill -USR1 $(cat /run/php-fpm.pid 2>/dev/null) 2>/dev/null || true
    endscript
}

# Query recent errors:
journalctl -u php-fpm --since '1 hour ago' | grep -i error
grep -r 'Fatal error' /var/log/php/

References

• ↗ https://linux.die.net/man/8/logrotate

Tags

Related Terms