Examples Log Queries & Find on Ubuntu

Fix log time to server timezone

sudo service cron restart
sudo service rsyslog restart

Firewall

tail /var/log/ufw.log
awk '{print $1,$2,$8,$12,$21,$22}' /var/log/ufw.log
awk '{print $1,$2,$3,$8,$12,$21,$22}' /var/log/ufw.log
awk '{print $1,$2,$3,$8,$12,$13,$22}' /var/log/ufw.log
awk '{print $12}' /var/log/ufw.log |sort -u
tail | awk '{print $12}' /var/log/ufw.log |sort -u
tail | awk '{print $12}' /var/log/ufw.log
sudo grep BLOCK /var/log/ufw.log
sudo grep --color 'BLOCK\|DPT=21' /var/log/ufw.log
sudo tail /var/log/ufw.log | grep BLOCK
tail -F /var/log/ufw.log | sed -n -e '/BLOCK/ {s/.*$SRC=[^ ]*$.*/\1/p}'
sudo grep -v "unwanted_word" /var/log/ufw.log | grep XXXXXXXX
tail -f /var/log/ufw.log | grep BLOCK
tail -1f /var/log/ufw.log | grep BLOCK
tail -1f /var/log/ufw.log | grep -Po 'BLOCK.*\KSRC=\S+'

Disk and Folders size

disk size df -h
disk size 3 folders level sudo du -h --max-depth=3 /var/www/html/ | sort -h > /var/tmp/treesize.html
check folder size sudo du -sh /var/www/html/wp-content/
sort by size sudo du -hs /var/ | sort -h
sort by size -as list cd /var/www/html/ du -hs .[^.]* * | sort -h
sort by size -as list cd /var/www/html/ sudo du -k * | sort -nr | cut -f2 | xargs -d '\n' du -sh
find the 10 largest directories find . -type d -print0 | xargs -0 du -s | sort -n | tail -10 | cut -f2 | xargs -I{} du -sh {} | sort -rn
only folders du -hd1 |sort -h
tree view du -h | sort -hr
tree view perl -e'%h=map{/.\s/;99**(ord$&&7)-$`,$_}`du -h`;die@h{sort%h}'
find zip file find . -name '*.zip' -type f -print | xargs du -ch
find file bigger than size sudo find /var/ -type f -size +5M -exec du -h {} \; | sort -n

Reference:http://www.commandlinefu.com/commands/tagged/124/du

Linux Apache

sudo nano /var/log/syslog
sudo nano /var/log/apache2/access.log
sudo nano /var/log/apache2/error.log
tail -f /var/log/apache2/error.log
find textstdbuf -o0 tail -f /var/log/apache2/access.log | awk -F" " '{print $1,$4,$7}' |grep 218.
find textawk '{print $1,$4,$7}' /var/log/apache2/access.log |grep 192.117
find texttail -f /var/log/apache2/access.log | grep --color=always 192.117
find textstdbuf -o0 tail -f /var/log/apache2/access.log | awk -F" " '{print $1,$4,$7}'
find textstdbuf -o0 tail -f /var/log/apache2/access.log | awk -F" " '{print $1,$4,$7,$11}'
find 2 wordsstdbuf -o0 tail -f /var/log/apache2/access.log | awk -F" " '{print $1,$4,$7}' | awk '/218/ && /jpg/'
tail -f /var/log/apache2/access.log | perl -pe 's/192.117/\e[1;31;43m$&\e[0m/g'
awk '{print $1,$4,$7}' /var/log/apache2/access.log
sudo apt-get install goaccess goaccess -f /var/log/apache2/access.log
sudo apt-get install grc
grc tail -f /var/log/apache2/error.log
sudo apt-get install source-highlight
tail -f /var/log/apache2/access.log | source-highlight -f esc -s log
sudo apt-get install apachetop
apachetop
sudo apt-get install goaccess
sudo zcat -f /var/log/apache2/access.log* | sudo goaccess > /var/tmp/webserverstats.html
open file ipserver/webserverstats.html sudo zcat -f /var/log/apache2/access.log* | sudo goaccess > /var/tmp/webserverstats.html

Monitor Apache with apachetop:
sudo apt-get -y install apachetop
apachetop -H hits

Monitor Apache with mod_status:
sudo nano /etc/apache2/mods-enabled/status.conf
change Require IP open print screen
sudo /etc/init.d/apache2 restart
http://ip/server-status

Reference:https://www.yanivp.net//www.maketecheasier.com/monitor-apache-mod_status/

Linux Nginx Web Server

sudo nano /var/log/nginx/access.log
sudo nano /var/log/nginx/error.log
awk '{print $1,$4,$7}' /var/log/nginx/access.log
stdbuf -o0 tail -f /var/log/nginx/access.log | awk -F" " '{print $1,$4,$7}'

MYSQL

enable logs sudo nano /etc/mysql/my.cnf
delete the # in:
general_log_file = /var/log/mysql/mysql.log
general_log = 1

sudo /etc/init.d/mysql restart
sudo nano /var/log/mysql/mysql.log
tail -f /var/log/mysql/mysql.log

error log
tail -f /var/log/mysql/error.log
tail -f /var/log/mysql/mysql_error.log

mytop tool
mytop = mysql monitor open print screen
apt-get install mytop
sudo nano /root/.mytop

Add these lines to the file /root/.mytop

host=localhost
db=dbname
delay=5
port=3306
socket=
batchmode=0
color=1
idle=1

sudo mytop --prompt
sudo mytop -d dbname --prompt

Reference:how-to-use-mytop-to-monitor-mysql-performance

CRON JOB

grep CRON /var/log/syslog
tail -f /var/log/syslog | grep CRON
sudo nano /etc/job1.sh AND add log file to bash file: 0 23 * * * ubuntu /etc/job1.sh >> /var/log/job1.log 2>&1

Add cron log instead of syslog:

sudo nano /etc/rsyslog.d/50-default.conf
delete # in #cron line
sudo service rsyslog restart
sudo service cron restart
sudo nano /var/log/cron.log
tail -f /var/log/cron.log | grep CRON

FTP

sudo tail -f /var/log/vsftpd.log
sudo tail -f /var/log/vsftpd.log | grep 'FAIL LOGIN'
sudo stdbuf -o0 tail -f /var/log/vsftpd.log | awk -F" " '{print $1,$2,$3,$8,$9,$10}'

TOP: view \ kill processes

view processes by ports sudo lsof -i TCP:25
kill processes by name sudo killall cron
list Only IPv4 sudo lsof -i 4
list open files of TCP port ranges 1-1024 sudo lsof -i TCP:1-1024
kill processes by user ubuntu kill -9 `lsof -t -u ubuntu`

Reference:http://www.tecmint.com/10-lsof-command-examples-in-linux/