Chapter 8 · 8.4
Reading logs with journalctl and docker logs
If something isn't working, the reason is almost always in a log. On Debian and Ubuntu, most messages end up in the systemd journal.
journalctl: the most important commands
| Command | What do you see? |
|---|---|
journalctl -u caddy | Everything from one service, in this case Caddy |
journalctl -u ssh --since today | All SSH logins from today |
journalctl -p err -b | All errors since the last restart |
journalctl -b -1 | What happened before the previous restart |
journalctl -f | Follow along live (stop with Ctrl+C) |
journalctl -e | Jump straight to the end |
Put sudo in front, or add yourself to the adm group (sudo usermod -aG adm anna), and you'll see all messages.
A typical search when your website isn't working:
anna@web1:~$ systemctl status nginx
anna@web1:~$ sudo journalctl -u nginx -p err --since "1 hour ago"
anna@web1:~$ sudo tail -n 50 /var/log/nginx/error.logContainer logs
anna@web1:/srv/diensten$ sudo docker compose logs --tail 100 vaultwarden
anna@web1:/srv/diensten$ sudo docker compose logs -f caddyOther logs you'll often need
/var/log/nginx/: nginx visitors and errors./var/log/fail2ban.log: who fail2ban has blocked./var/log/unattended-upgrades/: what was updated automatically./var/log/apt/history.log: which packages were installed and when.
Logs that take up too much space
anna@web1:~$ journalctl --disk-usage
anna@web1:~$ sudo journalctl --vacuum-size=500MThe journal cleans up after itself, but by default it can use up to 10 per cent of your disk (4 GB at most). You can limit container logs as described in Updating containers, cleaning up and limiting logs.