Skip to main content

Lab 11.2 - Log Analysis

Objectives​

  • Use journalctl to view systemd logs
  • Analyze /var/log
  • Search in logs
  • Configure logrotate

Exercise 1: journalctl​

# All logs
sudo journalctl

# Logs of a service
sudo journalctl -u sshd

# Follow in real-time
sudo journalctl -f

# By priority
sudo journalctl -p err

Exercise 2: /var/log​

# View system logs
ls -la /var/log/

# Analyze syslog
sudo tail -f /var/log/syslog

# Search for errors
sudo grep -i error /var/log/syslog | tail -20

Exercise 3: logrotate​

# View configuration
cat /etc/logrotate.conf

# Test
sudo logrotate -d /etc/logrotate.conf

Lab created on: December 2024 - Tested on Ubuntu 24.04