$ Linux One Liners
Back to lessons

Linux Survival Basics

Find Errors Before Reading Every Log Line

A log file has too much output and you need a quick first pass for failure words.

Command

grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40

What changed

Nothing changes. The command filters for common failure terms and shows the most recent matches.

Danger

safe

When to use it

Use this as a first pass before deeper log parsing.

When not to use it

Do not assume no matches means no failure. Logs may use different wording.

Undo or recovery

No state is changed.

Expected output

Recent matching lines containing likely failure terms.

demo script

Disposable terminal steps

  1. wc -l /var/log/nginx/error.log
  2. grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40
  3. grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel 
::fixture-ready::
$ wc -l /var/log/nginx/error.log
5 /var/log/nginx/error.log
::exit-code::0
$ grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -40
2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0
$ grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
2:2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
4:2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
5:2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0

YouTube Short

Find the failure words first.

Before reading every line, filter for the words that usually matter: error, failed, denied, and timeout.

LinkedIn hook

The error was in the log. The problem was finding it without reading noise.

Question: What failure words do you grep for first?

experiments

A/B tests to run

Metric: linkedin_save_rate

A: Find errors before reading every log line.

B: This grep pattern cuts through noisy logs.