$ Linux One Liners
Back to lessons

Linux Survival Basics

Show Only Recent Errors

A noisy log contains old and new errors, and you need the most recent likely failures.

Command

grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10

What changed

Nothing changes. The command filters likely failures and keeps the latest matches.

Danger

safe

When to use it

Use this during incident triage when recent failures matter more than old history.

When not to use it

Do not use it as a complete incident report; it intentionally drops older context.

Undo or recovery

No state is changed.

Expected output

The newest matching failure lines.

demo script

Disposable terminal steps

  1. tail -n 5 /var/log/nginx/error.log
  2. grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10
  3. grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10
Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel 
::fixture-ready::
$ tail -n 5 /var/log/nginx/error.log
2026/06/25 10:00:01 [notice] 11#11: start worker process
2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
2026/06/25 10:02:05 [warn] 11#11: upstream server temporarily disabled
2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0
$ grep -iE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10
2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0
$ grep -inE 'error|failed|denied|timeout' /var/log/nginx/error.log | tail -10
2:2026/06/25 10:01:42 [error] 11#11: *7 connect() failed (111: Connection refused) while connecting to upstream
4:2026/06/25 10:03:16 [error] 11#11: *9 access forbidden by rule, client: 203.0.113.44
5:2026/06/25 10:04:33 [error] 11#11: *10 upstream timed out while reading response header
::exit-code::0

YouTube Short

Show the newest errors only.

Old log lines can waste your time. Filter the likely errors and keep the newest matches first.

LinkedIn hook

The log had old failures too. I only cared about the newest ones.

Question: When logs are noisy, do you filter first or tail first?

experiments

A/B tests to run

Metric: linkedin_save_rate

A: Show only recent errors.

B: Stop reading old failures during a new incident.