Thuta Learning
Search
ProjectsDevOps & Toolsbeginner

Logs & Troubleshooting: journalctl, /var/log

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand Logs & Troubleshooting: journalctl, /var/log without any of the intimidation
  • Get comfortable trying these commands yourself in the terminal
  • See how these commands are actually useful on a real server/project

Let's think about it this way for a second

A log is basically a diary that records everything that's happened on your system or in your application — you'll find traditional log files (auth.log, syslog, and so on) under /var/log, while modern systemd-based distros keep a centralized binary log you view with the journalctl command. journalctl -u <service> filters down to just one service's logs (for example, journalctl -u nginx). journalctl -f is similar to tail -f — it monitors the live log in real time. journalctl --since "1 hour ago" is handy when you want to filter by a specific time range.

Let's connect it to a real scenario

When a service won't start (systemctl status shows 'failed'), run journalctl -u <service-name> -n 50 (the last 50 lines) and read the exact error message — messages like 'permission denied' or 'port already in use' point straight at the problem. If it's a web server error, tail -f /var/log/nginx/error.log for live monitoring while you reload the page, so you can watch exactly when the error shows up.

Let's try it together in the terminal

bash
journalctl -u nginx -n 50
journalctl -f
journalctl --since "1 hour ago"
tail -f /var/log/nginx/error.log
You should see
Running journalctl -u nginx -n 50 shows the last 50 log lines for the nginx service, each with a timestamp.

5-minute try-it

Try running journalctl -u ssh -n 20 (or journalctl -n 20) on a system where it's installed. Look for the three columns in the log: timestamp, service name, and message.

One thing to watch out for

Log files can contain passwords, API keys, and personal data — before copy-pasting a log onto a public forum like Stack Overflow, be sure to strip out any sensitive information.

Easy traps

  • Copy-pasting an error line straight into a forum or an AI without reading the log yourself first — reading it yourself first makes your search terms a lot more precise
  • Getting overwhelmed by scrolling through overly long journalctl output — limiting the number of lines with the -n flag makes it much easier

Now try it yourself

Try running journalctl -u ssh -n 20 (or journalctl -n 20) on a system where it's installed. Look for the three columns in the log: timestamp, service name, and message.

You'll know it worked when: Running journalctl -u nginx -n 50 shows the last 50 log lines for the nginx service, each with a timestamp.

Logs & Troubleshooting: journalctl, /var/log | Thuta Learning