A first look at logs
You learn from scratch where Linux writes down events, how to read a log line and how to follow a problem's trail through the logs.
Level 101 · 13 lessons · 12 practice labs
Lessons
What a log is
- What a log is: the system's diary
- A tour of /var/log: what lives where
- Reading a log line: time, host, program, message
- Short task: find the first error from yesterday morning
Tools
- Reading logs with less and tail -f
- Searching logs with grep
- First steps with journalctl: -u, -b and -f
- Who logged in and when: last, lastb and lastlog
- Short task: count the failed login attempts
Making sense of logs
- Severity levels: info, warning, error, critical
- Putting events in time order
- Personal data in logs and privacy
- Capstone: why was the website down for half an hour?
Practice labs
- Find where log files live: List the files in the log directory and submit the names of the three most recently changed.
- Break a log line into its parts: In five given log lines separate time, host name, program and message and mark the one reporting an error.
- Match which event goes to which log: Log in, install a package and restart a service, then find the log and line where each event landed.
- Follow a log live: While following a log file live, generate an event from a second terminal and show the line appear.
- Search a log for a keyword and count: Find lines containing the word error case-insensitively, submit their count and write the time it first appeared.
- Jump to a given moment in a large log: In a log of thousands of lines jump to a stated time with less and save the ten lines before and after the event to a file.
- Read recent entries with journalctl: Show the last fifty entries, filter to the current boot only and pick out one service's entries.
- Filter entries by priority: Show only entries at warning level and above and submit how many error entries there are today.
- Measure and limit the space the journal uses: Measure the journal's disk use, vacuum old entries to a size limit and define a permanent cap.
- Find why a service stopped from the log: Read a stopped service's last entries and submit the line that states why it stopped.
- Tell routine entries from the odd one: Among a day's entries set aside the routine repeated messages and find the unusual entry that appears only once.
- Write a short incident note from logs: Trace yesterday's access problem on the Gelincik Okulları server from the logs and write a note with what happened, when, and the evidence line.
About this course
You learn from scratch where Linux writes down events, how to read a log line and how to follow a problem's trail through the logs.
What you will learn
- What a log is
- Tools
- Making sense of logs
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.