Reading Your Server Logs: journalctl + GoAccess Without Losing Your Mind

Logs are the difference between "the server is slow" and "here is exactly why." Here is how I read mine without drowning.

The app: journalctl

With systemd, app logs go to the journal:

journalctl -u myapp -f          # follow live
journalctl -u myapp --since "1 hour ago"   # recent window
journalctl -u myapp -p err      # just errors

-p err is the trick: most of the log is noise, and errors are what matter. Start with errors, then widen.

The traffic: GoAccess on the access log

For web traffic, GoAccess turns the nginx access log into a dashboard:

goaccess /var/log/nginx/access.log -o /var/www/stats/index.html --log-format=COMBINED

It answers the questions that matter: which pages, which referrers, which countries, which status codes. No third-party script on the site, no data leaving the box.

The disk: log rotation

Unrotated logs fill the disk and take the server down. Set a hard limit in journald:

# /etc/systemd/journald.conf
SystemMaxUse=500M

And nginx ships with logrotate config by default — make sure the daily/size settings actually run. A server that dies because logs filled the disk is the most preventable outage there is.

The habit

• Errors first (-p err), then widen.
• Check the traffic dashboard weekly.
• Let rotation run; never let logs be the thing that kills the box.

Logs are cheap to write and expensive to ignore. If you are self-hosting the services that produce them, the calculator below will tell you what that choice really costs.