Hosting Operations
Read-onlyFind the Noisiest Incident Log Files
Several incident log files exist and you need to know which ones have the most lines before opening them.
Command
wc -l /var/log/app/*.log 2>/dev/null | sort -nrBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not confuse line volume with importance; a short kernel or deploy log can still explain the incident.
Expected output
Line counts sorted from largest to smallest.
System impact
Read-only. Nothing changes. The command counts lines per log file and sorts the result.
May require elevated permissions on protected paths or service-owned files.
Recovery / rollback: no state is changed.
When to use it
Use when a service emits several logs and you need a quick noise map.
When not to use it
Do not confuse line volume with importance; a short kernel or deploy log can still explain the incident.
next steps
Related commands
Rank Old Cleanup Candidates by Size
The oldest file is not always the file that buys back meaningful space.
find /var -xdev -type f -mtime +7 -printf '%s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head
Review Log Files Before Cleanup
Before truncating logs, prove which log files are large and how old they are.
find /var/log -xdev -type f -printf '%10s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head -50
Build a Deploy and Restart Timeline
Deploys and restarts are incident landmarks.
grep -Eh 'deploy|release|restart|started|stopped|rolled back' /var/log/app/*.log /var/log/deploy.log 2>/dev/null | sort
Find Directories Burning Inodes
Inode cleanup starts by finding the directory with too many files.
find /var/cache -xdev -type f -printf '%h\n' 2>/dev/null | sort | uniq -c | sort -nr | head
Count App Errors by Minute
A minute-by-minute count shows whether an incident is a spike or a drip.
awk 'tolower($0) ~ /(error|fatal|timeout|exception)/ {minute=substr($1,1,16); count[minute]++} END {for (m in count) print count[m], m}' /var/log/app/app.log | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.