Process Management and Log Aalysis
3️⃣ Process Management
A process is a running program.
Example:
nginx
docker
mysql
ps
Shows running processes.
ps aux
Meaning:
| Option | Meaning |
|---|---|
| a | all users |
| u | detailed format |
| x | background processes |
Example:
ps aux | grep nginx
Find nginx process.
top
Real-time process monitor.
top
Shows:
CPU usage
memory usage
running processes
htop
Improved version of top.
htop
More user-friendly.
kill
Stop process.
Example:
kill 1234
Where 1234 = PID.
kill -9
Force kill process.
kill -9 1234
Used when process refuses to stop.
nice
Controls process priority.
Example:
nice -n 10 command
Lower priority process.
1️⃣ Log Analysis in Linux
What are logs?
Logs are text records generated by applications and the operating system that describe what happened during execution.
Examples of logged information:
system boot events
user login attempts
application errors
API requests
database queries
container activity
Logs help answer questions like:
Why did the application crash?
Why is the server slow?
Why are users getting 500 errors?
Did someone attempt unauthorized login?
2️⃣ Common Log Location in Linux
Most logs in Linux are stored in:
/var/log
/var stores variable data, and logs change frequently.
Example:
ls /var/log
You may see:
syslog
auth.log
kern.log
nginx/
apache2/
docker.log
Important Log Files
| Log File | What it Records |
|---|---|
/var/log/syslog |
General system events |
/var/log/auth.log |
Login and authentication attempts |
/var/log/kern.log |
Kernel events |
/var/log/nginx/access.log |
HTTP requests |
/var/log/nginx/error.log |
Web server errors |
/var/log/apache2/error.log |
Apache errors |
Production Example
If a website returns 500 Internal Server Error, check:
/var/log/nginx/error.log
You might see:
connect() failed (111: Connection refused) while connecting to upstream
This indicates backend service is down.
3️⃣ cat — Display Entire File
What it does
cat prints the entire content of a file to the terminal.
Example:
cat file.txt
Example output:
System started
Database connected
Application running
DevOps Use Case
Check configuration or logs quickly.
Example:
cat /var/log/syslog
Problem with cat
If the file is very large, the terminal will flood with data.
Example:
1GB log file
cat will print everything instantly.
So for large files we use less.
4️⃣ less — View Large Files Page by Page
less allows you to scroll through a large file interactively.
Example:
less logs.txt
Navigation inside less:
| Key | Action |
|---|---|
| Space | next page |
| b | previous page |
| /word | search word |
| q | quit |
Example
less /var/log/syslog
Search for errors:
/error
DevOps Production Use Case
Imagine a 10GB log file.
Instead of:
cat app.log
Use:
less app.log
This allows you to search quickly without loading everything into memory.
5️⃣ head — Show First Lines of File
head displays the beginning of a file.
Example:
head logs.txt
Default:
first 10 lines
Specify number of lines
Example:
head -n 20 logs.txt
Shows first 20 lines.
DevOps Use Case
Check startup logs.
Example:
head /var/log/nginx/error.log
This may show initial errors during service start.
6️⃣ tail — Show Last Lines of File
tail shows the end of a file.
Example:
tail logs.txt
Default:
last 10 lines
Show specific lines
tail -n 50 logs.txt
Shows last 50 lines.
DevOps Use Case
Most recent logs appear at the end of the file.
Example:
tail /var/log/syslog
This shows latest system events.
7️⃣ tail -f — Real-Time Log Monitoring
This is one of the most used commands in DevOps debugging.
tail -f file
The -f means follow the file in real time.
Example:
tail -f /var/log/nginx/access.log
As new requests arrive, they appear instantly.
Example output:
192.168.1.5 GET /index.html 200
192.168.1.6 POST /login 302
192.168.1.8 GET /dashboard 200
🚀 Real Production Debugging Example
Problem
Users say:
Website is slow
Step 1 — Monitor requests
tail -f /var/log/nginx/access.log
You may see:
大量 requests from same IP
Possible DDoS attack.
Step 2 — Check errors
tail -f /var/log/nginx/error.log
Example error:
upstream timed out
This means backend service is slow.
Step 3 — Check system logs
less /var/log/syslog
Maybe memory issue:
Out of memory: Kill process
🔧 DevOps Scenario (CI/CD Deployment)
During deployment:
docker container crashes
Check logs:
docker logs container_id
Or if application logs stored:
tail -f /var/log/app.log
You might see:
Database connection refused
Meaning database not reachable.
📊Common Log Analysis Workflow
DevOps engineers usually do:
tail -f logfile
reproduce issue
watch logs in real time
identify error
Example:
tail -f /var/log/nginx/error.log
Then refresh website and watch errors.
🔥 Advanced DevOps Trick
Combine commands with grep.
Example:
grep ERROR app.log
Or:
tail -f app.log | grep ERROR
Shows only error lines.
📌 Summary
| Command | Purpose |
|---|---|
cat |
print entire file |
less |
view large files interactively |
head |
show first lines |
tail |
show last lines |
tail -f |
real-time log monitoring |
⭐ Why Log Analysis is Critical in DevOps
Logs help:
detect production errors
debug deployments
monitor system health
track user activity
investigate security incidents
Without logs, troubleshooting production systems becomes extremely difficult.