Build a Deploy and Restart Timeline

You need to compare deploy activity, restarts, and rollbacks against application errors.

Command

grep -Eh 'deploy|release|restart|started|stopped|rolled back' /var/log/app/*.log /var/log/deploy.log 2>/dev/null | sort

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Do not use it as proof that deploy caused the incident; use it to focus the next investigation step.

Expected output

Timestamped deploy, release, restart, and rollback lines.

System impact

Read-only, can be slow. Nothing changes. The command prints matching event lines in timestamp order.

May require elevated permissions on protected paths or service-owned files.

Scope this to the smallest useful path or service on busy systems.

Recovery / rollback: no state is changed.

When to use it

Use when an incident may correlate with a release switch, restart, or rollback.

When not to use it

Do not use it as proof that deploy caused the incident; use it to focus the next investigation step.

next steps

Related commands

Hosting Operations Read-only

Find the Noisiest Incident Log Files

The biggest log is not always right, but it is worth knowing.

wc -l /var/log/app/*.log 2>/dev/null | sort -nr

Hosting Operations Can be slow

Count Request IDs in Error Lines

Repeated request IDs can connect separate error lines to one failing path.

grep -Ei 'error|timeout|fatal|exception' /var/log/app/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr

Hosting Operations Can be slow

Review Log Files Before Cleanup

Before truncating logs, prove which log files are large and how old they are.

find /var/log -xdev -type f -printf '%10s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head -50

Hosting Operations Read-only

Count App Errors by Minute

A minute-by-minute count shows whether an incident is a spike or a drip.

awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr

Cybersecurity Triage Sensitive output

Redact Secret-Looking Log Lines

Incident notes should not copy secrets forward.

grep -RInEi '(password|token|secret|authorization)' /var/log/app /var/log/deploy.log 2>/dev/null | sed -E 's/((password|token|secret)[[:space:]]*[:=])[[:alnum:]_.-]+/\1REDACTED/Ig; s/([Aa]uthorization[[:space:]]*:[[:space:]]*[Bb]earer[[:space:]]+)[[:alnum:]_.-]+/\1REDACTED/g'

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.