Logs

tail — the last lines and following a log

The tail command prints the end of a file, and with -f it keeps showing new lines as they are appended to a log.

journalctl — reading the systemd journal

Reading the systemd journal (journald) — filters by service, time, priority.

Log rotation with logrotate

Keeping logs from filling the disk — rotation, compression, retention, checking configs.

dmesg — kernel messages: OOM, disk and filesystem errors, segfaults

dmesg prints the kernel ring buffer: messages about disks, filesystems, OOM, crashed programs and hardware.

rsyslog — system logs

Writes text logs to /var/log and forwards them over the network; it does not rotate them itself, that's logrotate's job.

auditd — security auditing

Kernel-level auditing — who did what and when; watch rules and event search.

fail2ban

Log-based banning — protecting SSH and services from brute force; jails, status, unban.