Back to lessons

Linux Survival Basics

Find the Exact Log Line Before You Scroll

A log file contains likely failures, but you need line numbers so you can inspect context around the match.

Command

grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log

What changed

Nothing changes. The command prints matching lines with line numbers for follow-up inspection.

Danger

safe

When to use it

Use this when a first-pass grep finds failures and you need the surrounding context next.

When not to use it

Do not assume these four words catch every failure; applications often log custom error language.

Undo or recovery

No state is changed.

Expected output

Matching log lines prefixed by their line numbers.

demo script

Disposable terminal steps

  1. grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log
  2. grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
  3. sed -n '2,5p' /var/log/nginx/error.log

simulated output

What it looks like

disposable vessel
::fixture-ready::
$ grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log
2:2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
4:2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
5:2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0
$ grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -20
2:2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
4:2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
5:2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0
$ sed -n '2,5p' /var/log/nginx/error.log
2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
2026/06/25 10:02:05 [warn] 11#11: upstream server temporarily disabled
2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0

YouTube Short

Find the exact log line first.

Line numbers make log debugging faster. First find the failure, then inspect the few lines around it instead of scrolling forever.

LinkedIn hook

The error was there. The useful part was knowing exactly where it was.

Question: Do you jump straight into logs, or search for line numbers first?

experiments

A/B tests to run

Metric: linkedin_save_rate

A: Find the exact log line before you scroll.

B: Use `grep -n` before reading the whole log.