Linux Survival Basics
Read-only, can be slowFind Errors Before Reading Every Log Line
A log file has too much output and you need a quick first pass for likely failure lines.
Command
grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not assume no matches means no failure. Logs may use different wording, and matching lines may include secrets or customer data.
Expected output
Recent matching lines containing likely failure terms.
System impact
Read-only, can be slow. Nothing changes. The command filters for common failure terms and shows the most recent matches.
May require elevated permissions on protected paths or service-owned files.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use this as a first pass before deeper log parsing, especially when you need the most likely failure lines quickly.
When not to use it
Do not assume no matches means no failure. Logs may use different wording, and matching lines may include secrets or customer data.
Watch this command run
Command transcript
This sanitized transcript shows the commands and output shape without exposing host details.
$ wc -l /var/log/nginx/error.log
5 /var/log/nginx/error.log$ grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40
2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header$ grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
2:2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
4:2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
5:2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response headerView commands shown
These are the commands shown in the sanitized transcript.
Commands shown
wc -l /var/log/nginx/error.loggrep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
next steps
Related commands
Show Only Recent Errors
The log had old failures too. I only cared about the newest ones.
grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10
Find the Exact Log Line Before You Scroll
The error was there. The useful part was knowing exactly where it was.
grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log
Watch Logs Without Opening the Whole File
The app was failing now. Opening a giant log file was the wrong move.
tail -n 80 -f /var/log/nginx/error.log
Read Current-Boot Logs for One Service
Ignore stale logs and inspect only what happened since this boot.
journalctl -u nginx -b --no-pager -n 80
Show Context Around the First App Error
The first error often explains more than the last one.
awk '{buf[NR%5]=$0} tolower($0) ~ /(error|exception|fatal)/ {for (i=NR-4;i<=NR;i++) if (i>0) print buf[i%5]; exit}' fixtures/incidents/app.log
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Useful for
- LPIC-1 style command-line practice
- LFCS style performance tasks
- Linux+ style troubleshooting review
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.