Hosting Operations
Read-only, can be slowBuild a Restart Loop Timeline
A service keeps restarting and you need to separate the first application failure from later supervisor retries.
Command
journalctl -u app-worker -b --no-pager -o short-iso | grep -E 'Started|Failed|Scheduled restart|Main process exited'Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not use this as the only diagnosis; read the adjacent app log lines around the first failure.
Expected output
Timestamped service lifecycle lines showing starts, main-process exits, failed results, and scheduled restarts.
System impact
Read-only, can be slow. Nothing changes. The pipeline prints a compact timeline of start, failure, and restart-counter lines.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use when Restart=on-failure is hiding the first useful failure under repeated retries.
When not to use it
Do not use this as the only diagnosis; read the adjacent app log lines around the first failure.
next steps
Related commands
Find the First Failure Line for One Unit
The first failure line is often more useful than the last restart message.
journalctl -u app-worker -b --no-pager -o short-iso | grep -m1 -E 'ERROR|Failed|status='
Read Warning and Error Logs for One Failed Unit
Filter a failed unit's journal to the lines most likely to explain the stop.
journalctl -u app-worker -b -p warning..alert --no-pager -n 80
Print a Critical Journal Timeline
Timeline beats guesswork when several failures happen close together.
journalctl -p err..alert --since "2 hours ago" --no-pager -o short-iso | awk '{print $1, $3, $4, substr($0,index($0,$5))}'
Build a Deploy and Restart Timeline
Deploys and restarts are incident landmarks.
grep -Eh 'deploy|release|restart|started|stopped|rolled back' /var/log/app/*.log /var/log/deploy.log 2>/dev/null | sort
Summarize Journal Severity During an Incident
Start with severity counts before opening every log line.
journalctl -p warning..alert --since "2 hours ago" --no-pager -o short-iso | awk '{count[$4]++} END {for (level in count) print count[level], level}' | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.