Logs
🏠The everyday picture
A building's security office keeps recordings from every camera, labelled by time and place, so when something goes wrong, they can find exactly what happened.
📘What it really is
- journald (part of systemd) collects logs from services and the system. Read them with journalctl:
journalctl -u crm-api: one service's logs;journalctl -u crm-api -f: follow live;journalctl -u crm-api --since "1 hour ago";-
journalctl -p err -b: errors since the last boot. -
Your app's structured JSON logs (Module 45) printed to the console land in journald automatically.
- Other important logs:
/var/log/auth.log: sign-ins and sudo use (look for repeated failed SSH logins);/var/log/nginx/access.loganderror.log(Module 66);-
/var/log/syslog: general system messages. -
Log rotation: logs grow forever unless rotated. logrotate (and journald's own limits) compress and delete old logs. Check
journalctl --disk-usage. -
For several servers, or to search logs easily, send them to a central service (Module 72).
- Logs may contain personal data: limit who can read them and how long they're kept (Module 79).
🖱️Try it
Use journalctl -u crm-api -f while making requests to your app. Find your restart from Lesson 3 in the logs. Look at
/var/log/auth.log for your SSH logins (and any failed attempts). Check how much space journald uses, and set a limit
(SystemMaxUse=200M in /etc/systemd/journald.conf).
✅Quick check
How do you follow one service's logs live?
Show the answer
journalctl -u servicename -f.
Why rotate logs?
Show the answer
Without rotation, logs grow until they fill the disk.