🧾 SOP: Viewing Nginx & Application Logs (Fast Debug)
📘 Overview
This SOP helps you quickly locate and analyze logs for:
- Nginx (web server / reverse proxy)
- Application logs
- System & service logs
All paths are under
/var/logunless mentioned.
⚡ Quick Log Location Table
| Component | Log Type | Path |
|---|---|---|
| Nginx | Access log | /var/log/nginx/access.log |
| Nginx | Error log | /var/log/nginx/error.log |
| App (custom) | App logs | /var/log/<app-name>/ |
| Docker | Container logs | docker logs <container> |
| Kubernetes | Pod logs | kubectl logs <pod> |
| System | OS logs | /var/log/syslog |
| Auth | SSH / sudo | /var/log/auth.log |
🌐 Nginx Logs
View live traffic
tail -f /var/log/nginx/access.logView only errors
tail -f /var/log/nginx/error.logLast 100 errors (fast)
tail -n 100 /var/log/nginx/error.logSearch by status code
grep "502" /var/log/nginx/access.logSearch by IP
grep "10.0.0.12" /var/log/nginx/access.log🧱 Application Logs
Common locations
ls -lh /var/log/
ls -lh /var/log/<app-name>/Live app log
tail -f /var/log/<app-name>/app.logError-only view
grep -i error /var/log/<app-name>/app.logLast crash/debug lines
tail -n 200 /var/log/<app-name>/app.log🐳 Docker Logs
List containers
docker psView logs
docker logs <container-name>Live logs
docker logs -f <container-name>Last 100 lines
docker logs --tail 100 <container-name>☸️ Kubernetes Logs
Pod logs
kubectl logs <pod-name>Live logs
kubectl logs -f <pod-name>Previous crash logs
kubectl logs <pod-name> --previousNamespace-specific
kubectl logs <pod-name> -n <namespace>🖥️ System / OS Logs
General system issues
tail -f /var/log/syslogBoot & service errors
journalctl -xeService-specific logs
journalctl -u nginx
journalctl -u docker🔐 Auth & Access Issues
SSH / sudo failures
tail -f /var/log/auth.logSearch denied access
grep -i denied /var/log/auth.log🚨 Common Scenarios → What to Check
| Issue | Check This |
|---|---|
| 502 / 504 | Nginx error log + app logs |
| 403 | Nginx error + WAF / auth logs |
| App crash | App logs + kubectl logs --previous |
| Container restart | Docker logs |
| Server slow | syslog + app logs |
| Login issue | /var/log/auth.log |
🧠 Best Practices (Follow Always)
- Start with error logs, not access logs
- Use
tail -fduring live debugging - Use
grepto reduce noise - Match timestamps between Nginx & app logs
- For prod → never delete logs, rotate instead
⚙️ Command Summary
| Purpose | Command |
|---|---|
| Live Nginx access | tail -f /var/log/nginx/access.log |
| Live Nginx error | tail -f /var/log/nginx/error.log |
| App logs | tail -f /var/log/<app>/app.log |
| Docker logs | docker logs -f <container> |
| K8s logs | kubectl logs -f <pod> |
| System errors | journalctl -xe |
| Auth logs | tail -f /var/log/auth.log |