# Process Management and Log Aalysis

# 3️⃣ Process Management

A **process** is a running program.

Example:

```plaintext
nginx
docker
mysql
```

* * *

## `ps`

Shows running processes.

```plaintext
ps aux
```

Meaning:

| Option | Meaning |
| --- | --- |
| a | all users |
| u | detailed format |
| x | background processes |

Example:

```plaintext
ps aux | grep nginx
```

Find nginx process.

* * *

## `top`

Real-time process monitor.

```plaintext
top
```

Shows:

*   CPU usage
    
*   memory usage
    
*   running processes
    

* * *

## `htop`

Improved version of `top`.

```plaintext
htop
```

More user-friendly.

* * *

## `kill`

Stop process.

Example:

```plaintext
kill 1234
```

Where `1234` = PID.

* * *

## `kill -9`

Force kill process.

```plaintext
kill -9 1234
```

Used when process refuses to stop.

* * *

## `nice`

Controls process priority.

Example:

```plaintext
nice -n 10 command
```

Lower priority process.

* * *

# 1️⃣ Log Analysis in Linux

## What are logs?

Logs are **text records generated by applications and the operating system** that describe what happened during execution.

Examples of logged information:

*   system boot events
    
*   user login attempts
    
*   application errors
    
*   API requests
    
*   database queries
    
*   container activity
    

Logs help answer questions like:

*   Why did the application crash?
    
*   Why is the server slow?
    
*   Why are users getting 500 errors?
    
*   Did someone attempt unauthorized login?
    

# 2️⃣ Common Log Location in Linux

Most logs in Linux are stored in:

```plaintext
/var/log
```

`/var` stores **variable data**, and logs change frequently.

Example:

```plaintext
ls /var/log
```

You may see:

```plaintext
syslog
auth.log
kern.log
nginx/
apache2/
docker.log
```

* * *

## Important Log Files

| Log File | What it Records |
| --- | --- |
| `/var/log/syslog` | General system events |
| `/var/log/auth.log` | Login and authentication attempts |
| `/var/log/kern.log` | Kernel events |
| `/var/log/nginx/access.log` | HTTP requests |
| `/var/log/nginx/error.log` | Web server errors |
| `/var/log/apache2/error.log` | Apache errors |

## Production Example

If a website returns **500 Internal Server Error**, check:

```plaintext
/var/log/nginx/error.log
```

You might see:

```plaintext
connect() failed (111: Connection refused) while connecting to upstream
```

This indicates **backend service is down**.

* * *

# 3️⃣ `cat` — Display Entire File

## What it does

`cat` prints the **entire content of a file** to the terminal.

Example:

```plaintext
cat file.txt
```

Example output:

```plaintext
System started
Database connected
Application running
```

* * *

## DevOps Use Case

Check configuration or logs quickly.

Example:

```plaintext
cat /var/log/syslog
```

* * *

## Problem with `cat`

If the file is **very large**, the terminal will flood with data.

Example:

```plaintext
1GB log file
```

`cat` will print everything instantly.

So for large files we use `less`.

* * *

# 4️⃣ `less` — View Large Files Page by Page

`less` allows you to **scroll through a large file interactively**.

Example:

```plaintext
less logs.txt
```

Navigation inside `less`:

| Key | Action |
| --- | --- |
| Space | next page |
| b | previous page |
| /word | search word |
| q | quit |

* * *

## Example

```plaintext
less /var/log/syslog
```

Search for errors:

```plaintext
/error
```

* * *

## DevOps Production Use Case

Imagine a **10GB log file**.

Instead of:

```plaintext
cat app.log
```

Use:

```plaintext
less app.log
```

This allows you to **search quickly without loading everything into memory**.

* * *

# 5️⃣ `head` — Show First Lines of File

`head` displays the **beginning of a file**.

Example:

```plaintext
head logs.txt
```

Default:

```plaintext
first 10 lines
```

* * *

## Specify number of lines

Example:

```plaintext
head -n 20 logs.txt
```

Shows first 20 lines.

* * *

## DevOps Use Case

Check **startup logs**.

Example:

```plaintext
head /var/log/nginx/error.log
```

This may show **initial errors during service start**.

# 6️⃣ `tail` — Show Last Lines of File

`tail` shows the **end of a file**.

Example:

```plaintext
tail logs.txt
```

Default:

```plaintext
last 10 lines
```

* * *

## Show specific lines

```plaintext
tail -n 50 logs.txt
```

Shows last 50 lines.

* * *

## DevOps Use Case

Most recent logs appear at the **end of the file**.

Example:

```plaintext
tail /var/log/syslog
```

This shows **latest system events**.

* * *

# 7️⃣ `tail -f` — Real-Time Log Monitoring

This is one of the **most used commands in DevOps debugging**.

```plaintext
tail -f file
```

The `-f` means **follow the file in real time**.

Example:

```plaintext
tail -f /var/log/nginx/access.log
```

As new requests arrive, they appear instantly.

Example output:

```plaintext
192.168.1.5 GET /index.html 200
192.168.1.6 POST /login 302
192.168.1.8 GET /dashboard 200
```

* * *

# 🚀 Real Production Debugging Example

### Problem

Users say:

```plaintext
Website is slow
```

Step 1 — Monitor requests

```plaintext
tail -f /var/log/nginx/access.log
```

You may see:

```plaintext
大量 requests from same IP
```

Possible **DDoS attack**.

* * *

Step 2 — Check errors

```plaintext
tail -f /var/log/nginx/error.log
```

Example error:

```plaintext
upstream timed out
```

This means **backend service is slow**.

* * *

Step 3 — Check system logs

```plaintext
less /var/log/syslog
```

Maybe memory issue:

```plaintext
Out of memory: Kill process
```

* * *

# 🔧 DevOps Scenario (CI/CD Deployment)

During deployment:

```plaintext
docker container crashes
```

Check logs:

```plaintext
docker logs container_id
```

Or if application logs stored:

```plaintext
tail -f /var/log/app.log
```

You might see:

```plaintext
Database connection refused
```

Meaning **database not reachable**.

## 📊Common Log Analysis Workflow

### DevOps engineers usually do:

1.  tail -f logfile
    
2.  reproduce issue
    
3.  watch logs in real time
    
4.  identify error
    

Example:

```plaintext
tail -f /var/log/nginx/error.log
```

Then refresh website and watch errors.

##   
🔥 Advanced DevOps Trick

Combine commands with `grep`.

Example:

```plaintext
grep ERROR app.log
```

Or:

```plaintext
tail -f app.log | grep ERROR
```

Shows only error lines.

* * *

# 📌 Summary

| Command | Purpose |
| --- | --- |
| `cat` | print entire file |
| `less` | view large files interactively |
| `head` | show first lines |
| `tail` | show last lines |
| `tail -f` | real-time log monitoring |

* * *

# ⭐ Why Log Analysis is Critical in DevOps

Logs help:

*   detect production errors
    
*   debug deployments
    
*   monitor system health
    
*   track user activity
    
*   investigate security incidents
    

Without logs, **troubleshooting production systems becomes extremely difficult**.

* * *