Learn › Linux for Production Support › Vijay reads logs without Event Viewer

Linux for Production Support Ch 6 / 32 Intermediate 🪟 Windows → Linux

📋

Vijay reads logs without Event Viewer

grep, tail, journalctl — log analysis that is faster than Event Viewer

⏱ 12 min 6 commands 5 takeaways

📋

In this chapter

Vijay

Windows support engineer, week 5 on Linux

The story

Week 5. Vijay needed to investigate an error from yesterday at 2pm. On Windows: open Event Viewer, navigate to the right log, filter by date and time, filter by error level. Sometimes 5 minutes just to get to the right place.

On Linux he did it in 20 seconds:

journalctl -u myapp --since "yesterday 14:00" --until "yesterday 15:00" -p err

WHERE ARE LOGS ON LINUX?

Windows Event Log          Linux equivalent
System                     /var/log/syslog or journalctl
Application                /var/log/appname/ or journalctl -u servicename
Security                   /var/log/auth.log
Setup                      /var/log/dpkg.log

ls /var/log/                # see all log categories
ls /var/log/nginx/          # nginx access.log and error.log
ls /opt/myapp/logs/         # application-specific logs

READING LOGS - Windows Notepad vs Linux tail and grep

cat /var/log/nginx/error.log        # print entire file
tail /var/log/nginx/error.log       # last 10 lines (like CMTrace latest)
tail -n 100 /var/log/nginx/error.log    # last 100 lines
tail -f /var/log/nginx/error.log    # LIVE view (like CMTrace tail mode)

SEARCHING LOGS - findstr becomes grep

Windows: findstr "error" app.log
Linux:   grep "error" app.log

Windows: findstr /i "error" app.log      (case insensitive)
Linux:   grep -i "error" app.log

Windows: findstr /n "error" app.log      (show line numbers)
Linux:   grep -n "error" app.log

Windows: findstr /s "error" *.log        (search all log files)
Linux:   grep -r "error" /var/log/myapp/

The most important grep:

grep -C 5 "ERROR" app.log      # show 5 lines AROUND each match
                               # see what happened before the error
                               # Windows has no easy equivalent

FILTERING BY TIME - Event Viewer time filter vs grep

journalctl --since "2026-03-16 14:00" --until "2026-03-16 15:00"
journalctl --since "1 hour ago"
journalctl --since today

For application text logs:

grep "2026-03-16 14:" app.log           # filter by hour
awk '/2026-03-16 14:00/,/2026-03-16 15:00/' app.log   # time range

FILTERING BY SEVERITY - Event Viewer level filter

journalctl -p err               # errors and above
journalctl -p warning           # warnings and above
grep "ERROR" app.log            # filter app log for errors
grep -v "INFO" app.log          # exclude INFO, show everything else

COMPRESSED OLD LOGS - Windows Archive vs Linux .gz files

ls /var/log/nginx/
# access.log  access.log.1  access.log.2.gz  access.log.3.gz

zcat access.log.2.gz            # read compressed log
zgrep "error" access.log.2.gz  # grep inside compressed log

COMBINING COMMANDS - where Linux beats Event Viewer

# Count errors by type, most frequent first:
grep "ERROR" app.log | awk '{print $NF}' | sort | uniq -c | sort -rn | head -10

# Find peak error hour:
grep "ERROR" app.log | cut -d: -f1 | sort | uniq -c

# Live monitoring for a specific error:
tail -f app.log | grep "OutOfMemoryError"

# Live monitoring with context around the error:
tail -f app.log | grep -A 3 "ERROR"

Vijay's conclusion by end of week 5: Event Viewer is easier for clicking around. grep is faster when you know what you are looking for. In production support, you almost always know what you are looking for.

Key takeaways

journalctl replaces Event Viewer — filter by service, time, and severity all in one command

tail -f is CMTrace tail mode — live log viewing that updates as new lines appear

grep -C 5 shows context around matches — there is no easy Windows equivalent

zgrep searches inside compressed .gz log files — old logs need not be uncompressed first

grep pipelines (grep | awk | sort | uniq -c) produce log analysis reports in seconds

Commands from this chapter

$ tail -f /var/log/myapp/app.log

CMTrace tail mode — watch live log updates

$ grep -i 'error' app.log

findstr /i equivalent — case-insensitive search in log file

$ grep -C 5 "ERROR" app.log

Show 5 lines around each error — Windows has no easy equivalent

$ journalctl -u servicename --since '1 hour ago' -p err

Event Viewer filtered by source, time, and error level in one command

$ zgrep 'error' app.log.2.gz

Search inside compressed old log files without extracting

$ grep 'ERROR' app.log | awk '{print $NF}' | sort | uniq -c | sort -rn

Count errors by type — instant frequency analysis