adminLinux Log Architecture Checklist for System Operators
Logs are the memory of a server. Linux stores system logs, service logs, web server logs, database logs, application logs and rotated archives in different places. Operators need to know where to look before an incident happens.
Core principle
Good troubleshooting starts with log location. If you do not know where a service writes logs, every incident becomes slower and more emotional.
Checklist
- Identify systemd journal logs.
- Identify Nginx access and error logs.
- Identify PHP-FPM logs.
- Identify MySQL or MariaDB logs.
- Identify Docker container logs.
- Identify application-specific logs.
- Check log rotation settings.
- Check whether logs are too large.
- Check whether logs contain sensitive data.
- Create a log map for critical services.
Reusable lesson
This applies to website outages, login attacks, PHP errors, database issues, Docker crashes, webhook failures and automation incidents.
When to Use This Checklist
Use this checklist when building a log map for a VPS, WordPress site, Docker stack or AI automation system.
Required Tools
SSH access, journalctl, Nginx logs, PHP-FPM logs, MySQL logs, Docker logs, logrotate config
Before You Start
Do not wait for an incident to discover where logs are stored. Build the log map before production problems happen.
Structured Checklist Steps
- Map journal logs.
- Map Nginx logs.
- Map PHP-FPM logs.
- Map database logs.
- Map Docker logs.
- Map app logs.
- Check log rotation.
- Check log size.
- Check sensitive data.
- Document log map.
Verification Steps
- Critical log locations are known.
- Log rotation is active.
- Large logs are identified.
- Sensitive logging risk is reviewed.
- Incident investigation becomes faster.
Rollback Plan
If log configuration changes break logging, restore the previous logrotate or service config and confirm logs are written again.
Common Mistakes
- Only checking one log file.
- Forgetting Docker logs.
- Ignoring log rotation.
- Logging secrets or tokens.
- No central map of service logs.
Related Commands
journalctl -xe
ls -lh /var/log/
sudo tail -n 100 /var/log/nginx/error.log
sudo tail -n 100 /var/log/nginx/access.log
docker logs container_name --tail 100
ls -la /etc/logrotate.d/