Log First Troubleshooting Checklist
Good operators read logs before guessing. Logs show what happened, when it happened and which layer failed. This checklist teaches a log-first method you can use across Nginx, PHP-FPM, MySQL, Docker, WordPress and automation services.
Core principle
Every incident has a timeline. Start with the time of failure, then read the logs around that time. Match browser symptoms with server evidence.
Checklist
- Record the exact time the issue happened.
- Record the URL or workflow that failed.
- Check Nginx access log for the request.
- Check Nginx error log for backend or permission errors.
- Check PHP-FPM or app logs if PHP or app is involved.
- Check MySQL logs if database is involved.
- Check Docker logs if the service runs in containers.
- Compare status codes with error messages.
- Separate one-time errors from repeated patterns.
- Write down the most likely root cause before changing anything.
Reusable skill
This method applies to 404, 500, 502, 504, webhook failures, Docker crashes, database errors and WordPress fatal errors.
When to Use This Checklist
Use this checklist when troubleshooting website or automation failures and you want to find evidence before changing settings.
Required Tools
SSH access, Nginx logs, PHP-FPM logs, MySQL logs, Docker logs, timestamp of issue
Before You Start
Collect the exact error time and affected URL or service before reading logs.
Structured Checklist Steps
- Record incident time.
- Record affected URL or service.
- Check access log.
- Check error log.
- Check PHP-FPM log.
- Check database log.
- Check Docker log if relevant.
- Compare status codes.
- Look for repeated patterns.
- Write likely root cause.
Verification Steps
- Relevant log lines are found.
- Error layer is identified.
- Status code matches symptom.
- Repeated pattern is known.
- Next action is based on evidence.
Rollback Plan
If a fix based on logs fails, keep the log evidence and revert the change before testing another hypothesis.
Common Mistakes
- Reading only the newest log lines without matching time.
- Ignoring access logs.
- Confusing symptoms with root cause.
- Changing settings before collecting evidence.
- Not saving important log excerpts.
Related Commands
sudo tail -n 100 /var/log/nginx/access.log
sudo tail -n 100 /var/log/nginx/error.log
docker logs container_name --tail 100
journalctl -u nginx --since "30 minutes ago"
journalctl -u php8.2-fpm --since "30 minutes ago"