Where are the important logs on a Linux web server and how do I read them quickly?

Where things live (Debian/Ubuntu defaults)

What	Where
Nginx access and errors	/var/log/nginx/access.log, error.log
Apache	/var/log/apache2/
PHP-FPM	/var/log/php8.3-fpm.log
MySQL / MariaDB	/var/log/mysql/error.log (or journal)
SSH logins	/var/log/auth.log
General system	/var/log/syslog
systemd services	the journal

Follow and filter

sudo tail -f /var/log/nginx/error.log
sudo journalctl -u myapp -f
sudo journalctl -u nginx --since "30 min ago"
sudo journalctl -p err -b          # errors since boot
grep " 500 " /var/log/nginx/access.log | tail

Useful one liners

# top client IPs
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head
# top requested URLs
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head
# status code counts
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c

Rotation. logrotate handles /var/log/nginx/*.log by default. For app logs add /etc/logrotate.d/myapp:

/var/www/myapp/storage/logs/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    copytruncate
}

Cap the journal size in /etc/systemd/journald.conf (SystemMaxUse=500M).

Pitfalls

• A full disk from unrotated logs causes mysterious failures; check df -h and du -sh /var/log/*.
• Docker logs: docker logs -f container (configure the json-file driver max-size and max-file).
• Never expose log files via the web root, and avoid logging secrets or tokens.