Logs are your first stop when something breaks. Traditionally they live as text files in /var/log (syslog, auth.log, dmesg, plus app-specific files). On systemd machines, the journal centralizes logs and you query it with journalctl — filterable by service, time, and priority.

The skill is filtering: a busy system produces millions of lines, so you narrow by unit (-u), time (--since), and severity (-p err) to find the signal.

journalctl -u nginx --since "1 hour ago"   # one service, recent
journalctl -p err -b                        # errors from this boot
journalctl -f                               # follow everything live
journalctl --since "2026-06-22 09:00"       # from a timestamp

tail -n 100 /var/log/syslog                  # last 100 lines
grep -i "failed" /var/log/auth.log           # failed logins

1. Show all error-priority messages from the current boot.
2. Follow a service’s logs live while you restart it.
3. Use grep to find failed SSH login attempts in /var/log/auth.log.
4. Filter the journal to the last 10 minutes for a single service.

• ↗ journalctl manual