Monitor Linux-serverlogs in realtime met staart

Waarom realtime logmonitoring belangrijk is

Serverlogboeken bieden een continu overzicht van wat er op een systeem gebeurt. Ze leggen applicatieactiviteit vast, webverzoeken, authenticatiepogingen, servicestoringen, gebeurtenissen voor e-mailbezorging, en nog veel meer.

Hoewel het bekijken van historische logboeken nuttig is voor het oplossen van eerdere incidenten, toezicht houden logs in real time allows administrators to identify and resolve problems as they occur. This can significantly reduce downtime and help diagnose issues faster.

Linux includes several built-in tools for viewing live log activity, with the most common being the tail command.

Understanding the tail Command

De tail utility displays the end of a file. Standaard, it shows the last ten lines.

Voorbeeld:

tail example.log

Output:

WordPress-webhosting

Vanaf $ 3,99/maandelijks

Koop nu

Line 1
Line 2
Line 3
...
Last 10 lines of the file

This is useful when examining recently added log entries without opening an entire log file.

Following a Log File in Real Time

The most commonly used option is:

tail -f logfile.log

Voorbeeld:

tail -f /var/log/messages

De -f flag means “follow”.

Instead of displaying the file once and exiting, tail remains active and continuously displays new log entries as they are written.

Voorbeeld:

Goedkope VPS-server

Vanaf $ 2,99/maandelijks

Koop nu

Jun 17 12:10:01 server sshd[1234]: Accepted password for admin
Jun 17 12:10:05 server sshd[1234]: Session opened
Jun 17 12:10:30 server systemd: Started backup service

As new events occur, additional lines appear automatically.

Stopping Real-Time Monitoring

To stop tail and return to the shell:

Ctrl + C

This safely terminates the monitoring session.

Displaying More Than Ten Lines

You can specify how many existing lines should be displayed before live monitoring begins.

Voorbeeld:

tail -n 50 -f /var/log/messages

This displays the last 50 lines and then continues monitoring new entries.

Windows VPS-hosting

Toegang op afstand en volledig beheer

Koop nu

Common examples:

tail -n 20 -f logfile.log
tail -n 100 -f logfile.log
tail -n 500 -f logfile.log

Monitoring Apache Logs

One of the most common troubleshooting scenarios involves web server errors.

Apache Error Log

On many Linux servers:

tail -f /usr/local/apache/logs/error_log

Of:

tail -f /var/log/httpd/error_log

Of:

tail -f /var/log/apache2/error.log

depending on the distribution.

Apache Access Log

To monitor incoming website traffic:

tail -f /var/log/httpd/access_log

Of:

tail -f /var/log/apache2/access.log

Voorbeelduitvoer:

192.168.1.10 - - [17/Jun/2026:12:30:10 +0000] "GET / HTTP/1.1" 200
192.168.1.15 - - [17/Jun/2026:12:30:12 +0000] "POST /login HTTP/1.1" 302

This allows you to verify requests are reaching the server.

Troubleshooting Website Errors

Suppose a page generates a 500 Interne serverfout.

Start monitoring the error log:

tail -f /var/log/apache2/error.log

Then reproduce the issue in your browser.

A corresponding error will often appear immediately:

PHP Fatal error: Uncaught Error: Call to undefined function

This helps identify the exact cause of the problem.

Monitoring Nginx Logs

Error Log

tail -f /var/log/nginx/error.log

Access Log

tail -f /var/log/nginx/access.log

Voorbeeld:

203.0.113.25 - - [17/Jun/2026:12:45:12 +0000] "GET /api/status HTTP/1.1" 200

Nginx logs are particularly useful when debugging reverse proxies, API's, en websites met veel verkeer.

Monitoring Email Delivery Logs

Mail services generate detailed logs that help diagnose delivery failures.

Exim

tail -f /var/log/exim_mainlog

Voorbeeld:

Completed

indicates Exim has finished handling that queue message; inspect its delivery or failure lines to establish the outcome.

Postfix

tail -f /var/log/maillog

Of:

tail -f /var/log/mail.log

Voorbeeld:

status=sent

indicates acceptance by the next hop, not guaranteed placement in the recipient’s inbox.

Duiventil

tail -f /var/log/dovecot.log

Useful for troubleshooting IMAP and POP3 login issues.

Monitoring SSH Activity

To monitor SSH logins and authentication attempts:

AlmaLinux, CentOS, Rotsachtige Linux

tail -f /var/log/secure

Ubuntu and Debian

tail -f /var/log/auth.log

Voorbeeld:

Accepted password for admin

Of:

Failed password for invalid user

These logs help detect brute-force attacks and unauthorized access attempts.

Monitoring System Logs

systemd Journal

Modern Linux systems use systemd.

View live system logs:

journalctl -f

Equivalent to tailing the system journal.

Voorbeeld:

Started Backup Service
Network interface eth0 up

Specific Service Logs

Monitor a single service:

journalctl -u nginx -f

Voorbeelden:

journalctl -u apache2 -f
journalctl -u mysql -f
journalctl -u sshd -f

This isolates output from a single service.

Monitoring MySQL and MariaDB Logs

Error logs are useful when diagnosing database crashes and startup failures.

Voorbeelden:

tail -f /var/log/mysqld.log

Of:

tail -f /var/log/mysql/error.log

Depending on configuration.

Voorbeeld:

InnoDB: Starting crash recovery

Monitoring Multiple Logs Simultaneously

You can monitor multiple files at once.

Voorbeeld:

tail -f access.log error.log

Output:

==> access.log <==
GET /index.php

==> error.log <==
PHP Fatal error

This is useful when troubleshooting web applications.

Filtering Logs with grep

Often you only want specific entries.

Voorbeeld:

tail -f access.log | grep --line-buffered POST

Display only POST requests.

Monitor only errors:

tail -f error.log | grep --line-buffered -i error

Monitor a specific IP:

tail -f access.log | grep --line-buffered -F 203.0.113.25

Monitor failed logins:

tail -f /var/log/secure | grep --line-buffered Failed

Using less for Large Logs

For historical investigation:

less /var/log/messages

Zoekopdracht:

/error

Move forward:

n

Move backward:

Shift + N

Quit:

q

Monitoring Log Rotation Safely

Some logs are rotated automatically.

Standard tail may stop following after rotation.

To handle log rotation correctly:

tail -F /var/log/nginx/access.log

Notice the capital:

-F

In tegenstelling tot -f, it automatically reconnects after log rotation.

This is generally preferred for long-term monitoring.

Advanced Real-Time Monitoring Tools

multitail

Monitor multiple logs in separate windows:

multitail /var/log/nginx/access.log /var/log/nginx/error.log

lnav

Interactive log analysis:

lnav

Provides searching, filtering, and SQL-style queries.

less +F

Follow mode inside less:

less +F logfile.log

Exit follow mode:

Ctrl + C

Common Log Locations

Paths depend on distribution and service configuration. If a file is absent, inspect the systemd journal and logging settings. Use sudo where required and protect logs that contain addresses, tokens or other sensitive data.

AlmaLinux / Rotsachtige Linux / CentOS

/var/log/messages
/var/log/secure
/var/log/maillog
/var/log/httpd/access_log
/var/log/httpd/error_log

Ubuntu / Debian

/var/log/syslog
/var/log/auth.log
/var/log/mail.log
/var/log/apache2/access.log
/var/log/apache2/error.log

Nginx

/var/log/nginx/access.log
/var/log/nginx/error.log

Beste praktijken

• Gebruik tail -F in plaats van tail -f for long-running sessions.
• Monitor logs while reproducing issues.
• Filter output with grep to reduce noise.
• Watch authentication logs for suspicious activity.
• Review web server logs during deployments.
• Combine journalctl and tail for complete troubleshooting.

Laatste gedachten

Real-time log monitoring is one of the most effective troubleshooting techniques available to Linux administrators. Whether you are diagnosing website errors, investigating email delivery problems, monitoring authentication attempts, or verifying application deployments, tools like tail, journalctl, En grep provide immediate visibility into what is happening on your server.

Learning to monitor logs effectively allows you to identify issues faster, improve system reliability, and maintain a more secure hosting environment.