Hosting Operations

Read-only, can be slow

Build a Deploy and Restart Timeline

You need to compare deploy activity, restarts, and rollbacks against application errors.

Command

grep -Eh 'deploy|release|restart|started|stopped|rolled back' fixtures/incidents/*.log | sort

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Do not use it as proof that deploy caused the incident; use it to focus the next investigation step.

Expected output

Timestamped deploy, release, restart, and rollback lines.

System impact

Read-only, can be slow. Nothing changes. The command prints matching event lines in timestamp order.

Scope this to the smallest useful path or service on busy systems.

Recovery / rollback: no state is changed.

When to use it

Use when an incident may correlate with a release switch, restart, or rollback.

When not to use it

Do not use it as proof that deploy caused the incident; use it to focus the next investigation step.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ ls sample-files/incidents/*.log

sample-files/incidents/app.log
sample-files/incidents/deploy.log

$ grep -Eh 'deploy|release|restart|started|stopped|rolled back' sample-files/incidents/*.log | sort

2026-06-25T13:58:00Z deploy started release=2026.06.25.2 actor=ci
2026-06-25T14:00:01Z level=INFO service=api request_id=req-100 msg=started release=2026.06.25.1
2026-06-25T14:04:44Z deploy release_switch release=2026.06.25.2
2026-06-25T14:04:44Z level=INFO service=deploy request_id=req-104 msg=release_switch release=2026.06.25.2
2026-06-25T14:05:12Z level=INFO service=system request_id=req-106 msg=worker_restarted
2026-06-25T14:05:12Z supervisor worker restarted after exit_code=137
2026-06-25T14:09:30Z deploy rolled back release=2026.06.25.1 reason=error_rate

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

ls fixtures/incidents/*.log
grep -Eh 'deploy|release|restart|started|stopped|rolled back' fixtures/incidents/*.log | sort

next steps

Related commands

Hosting Operations Read-only

Find the Noisiest Incident Log Files

The biggest log is not always right, but it is worth knowing.

wc -l fixtures/incidents/*.log | sort -nr

Hosting Operations Can be slow

Count Request IDs in Error Lines

Repeated request IDs can connect separate error lines to one failing path.

grep -Ei 'error|timeout|fatal|exception' fixtures/incidents/app.log | awk '{for (i=1;i<=NF;i++) if ($i ~ /^request_id=/) print $i}' | sort | uniq -c | sort -nr

Hosting Operations Read-only

Count App Errors by Minute

A minute-by-minute count shows whether an incident is a spike or a drip.

awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' fixtures/incidents/app.log | sort -nr

Hosting Operations Can be slow

Build a Restart Loop Timeline

Restart loops make more sense when you line up starts, failures, and counters.

journalctl -u app-worker -b --no-pager -o short-iso | grep -E 'Started|Failed|Scheduled restart|Main process exited'

Hosting Operations Can be slow

Check Image Tags in Manifests

Find the image tags your deployment files reference without printing env values.

grep -RhoE 'image:[[:space:]]*[^[:space:]]+' deploy/ | sort -u

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Build a Deploy and Restart Timeline

Before you run this

Expected output

System impact

When to use it

When not to use it

Command transcript

Commands shown

Related commands

Find the Noisiest Incident Log Files

Count Request IDs in Error Lines

Count App Errors by Minute

Build a Restart Loop Timeline

Check Image Tags in Manifests

Useful for