Logs are one of the most important tools in server management and one of the most ignored by people who are new to it. Here's why they matter and how to actually use them.
What logs are
Logs are timestamped records of events. Every significant thing a service does — requests received, errors encountered, connections made, things starting and stopping — gets written to a log file. When something breaks, the log is usually where you find out what actually happened and why.
Where they live
On Linux, most system and service logs are in /var/log/. The important ones:
/var/log/nginx/access.log— every request nginx handled/var/log/nginx/error.log— nginx errors/var/log/syslog— general system log/var/log/auth.log— authentication attempts including SSH
For Docker containers: docker logs container-name gets you the container's output. For systemd services: journalctl -u service-name.
The commands you actually use
# Watch logs in real time tail -f /var/log/nginx/error.log # Last 100 lines tail -n 100 /var/log/nginx/access.log # Search for specific text grep "ERROR" /var/log/nginx/error.log # Docker logs, follow docker logs -f container-name # Systemd journal, last hour journalctl -u nginx --since "1 hour ago"
tail -f is the one I use most. It streams new log entries in real time as they're written — invaluable when you're debugging something live or watching a deployment go out.
Reading an nginx access log
A typical access log line looks like this:
192.168.1.1 - - [15/Jul/2026:21:32:10 +0000] "GET /index.html HTTP/1.1" 200 1234
IP address, timestamp, request method and path, HTTP status code, response size. The status code is what you look at first — 200 is fine, 404 is not found, 500 is a server error. A spike of 500s in the access log means something is broken.
Logs filling your disk
Logs grow forever if left unchecked. logrotate handles this automatically on most Linux systems — it compresses and archives old logs and deletes ones older than a configured threshold. Check that it's configured and running, especially on servers that handle high traffic. A full disk because logs ate all the space is a real thing that happens.