Key Log Files
| Log File | Purpose |
|---|---|
/var/log/syslog |
System log (Ubuntu/Debian) |
/var/log/auth.log |
Authentication log |
/var/log/nginx/access.log |
Nginx access log |
/var/log/nginx/error.log |
Nginx error log |
/var/log/mysql/error.log |
MySQL error log |
Useful journalctl Commands
journalctl -u nginx -f # Watch nginx logs
journalctl --since "30 min ago" # Recent logs
journalctl -p err # Errors only
Real-Time Monitoring
tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log
Log Analysis Examples
# Count 5xx errors
grep 'HTTP/1.1" [5]..' /var/log/nginx/access.log | wc -l
# Top 10 IPs by request count
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10
# Top 10 URLs by request count
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10
See zh-cn version for complete logrotate config and monitoring scripts.