This guide walks Linux operations engineers through eleven practical checks—including log inspection, user file verification, login event analysis, network traffic monitoring, and file recovery via lsof—to identify and remediate compromised machines effectively.
This guide shows how to quickly locate errors in massive log files using Linux commands such as tail, head, grep, and sed, offering multiple techniques—including line‑number extraction, time‑range queries, match counting, colored highlights, and pagination—to streamline debugging and log analysis.
This article explains how the SLS Processing Language (SPL) enables interactive, pipeline‑based log analysis in cloud‑native environments, covering the challenges of unstructured log data, Unix‑inspired exploration, SPL syntax, key commands, and practical examples for efficient querying and transformation.
This guide explains Logstash’s Grok filter plugin, detailing how its 120 built‑in and custom patterns transform unstructured logs—such as Apache, MySQL, or HiveServer2—into structured fields through named regex captures, supporting type conversion, cleaning, debugging, and efficient ETL for analysis and monitoring.
This article explains what Apache access and error logs are, details the information they record, describes common log formats, shows where logs are stored on different operating systems, and offers guidance on analyzing and monitoring these logs for performance, security, and troubleshooting.
This guide explains why manual log review is tedious, introduces Logwatch as an automated solution, walks through installing it on CentOS, configuring its core settings, running it manually, and interpreting its concise email reports to simplify Linux system log management.
This guide explains why manual log inspection is tedious, introduces Logwatch as a solution, and provides step‑by‑step commands to install it on CentOS, configure its settings, run analyses instantly, and interpret the generated reports.
This guide explains why traditional tools struggle with massive log files and demonstrates how to use Linux's split command to divide logs by line count or size, then recombine them, making analysis faster, less memory‑intensive, and easier to share.
This article explains how to parse OceanBase logs to trace the tenant freeze dump workflow, detailing the roles and log sequences of the freeze check thread, LSFreeze, Flush, DagScheduler, and MiniMerge threads, and illustrating each step with actual log excerpts and code snippets.
This article presents a detailed, end‑to‑end case study of how Yanhuang Data leveraged the Honghu data‑analysis platform to build a complete Nginx operations‑management solution, covering data ingestion, parsing, modeling, visualization, alerting, third‑party integration, and best‑practice recommendations.
This guide explains how to identify and differentiate malicious bot traffic from legitimate requests by analyzing web server logs, leveraging fields such as IP, user‑agent, referer, and parameters, and then applying WAF rules, automation, and security platforms to mitigate attacks and improve operational metrics.
This tutorial walks you through setting up a unified ELK (Elasticsearch, Logstash, Kibana) log analysis platform on Ubuntu, covering component installation, configuration for Spring Boot and Nginx logs, Grok parsing, and using Supervisor to run the services as background daemons.
Logwatch, a built‑in CentOS log analysis tool, can be installed via yum, configured by copying the default config, and scheduled through cron to automatically email root daily summaries of system logs, simplifying server monitoring and reducing manual log inspection.
This guide explains how to install Logwatch on CentOS, configure its settings, run it manually or via daily cron, and interpret the sample email output that summarizes system logs, SSH activity, installed packages, and disk usage.
This article explains why centralized logging is essential for modern micro‑service systems, outlines an ELK‑based architecture with Filebeat, Kafka, Logstash, Elasticsearch and Kibana, and provides detailed configuration examples for both file‑based and Kubernetes‑based log collection, plus visualization techniques.
This article outlines key strategies and Python tools for server monitoring, including defining metrics, utilizing libraries like psutil and requests, log analysis, load testing with Locust and PyTest, and implementing automated alerts for high availability.
This guide explains why log analysis is essential for Linux system health, walks through installing Logwatch on CentOS, configuring its core settings, automating daily runs via cron, and interpreting sample output for connections, SSH activity, package installs, and disk usage.
This presentation explores the fundamental concepts of large language models, their evolution in natural language processing for ICT, practical applications in log‑driven operations, experimental results of models like BigLog and LogXXX, and future visions for AI‑driven autonomous operation.
This article walks through JVM GC log analysis and tuning, covering monitoring steps, parameter settings, log interpretation, and using the free GCEasy visualizer to identify performance issues and optimize Java applications.
This guide presents a comprehensive collection of Bash one‑liners—using awk, grep, sort, uniq, netstat, and other utilities—to count unique IPs, rank page visits, filter bots, analyze traffic by time windows, compute bandwidth, and monitor connection states from Apache or Nginx access logs.
This guide walks you through practical Linux commands—tail, head, cat, grep, sed, wc, and pagination tools—to quickly locate, filter, and examine specific error entries within large log files, boosting troubleshooting efficiency for system administrators.
This guide presents practical Linux commands and step‑by‑step methods—such as tail, head, grep, sed, and pagination tools—to quickly locate errors, filter by time range, count occurrences, and navigate large log files efficiently for system administrators.
This article examines the challenges and value of log analysis, introduces the concepts of schema‑on‑read versus schema‑on‑write, and details how the Honghu platform implements real‑time, one‑stop heterogeneous data analytics with flexible storage, indexing, and SQL‑based query engines.
This guide shows how to quickly locate errors in massive server logs by using Linux commands such as tail, cat, grep, sed, head, and pagination tools, offering multiple practical techniques for pinpointing problematic entries.
This guide shows how to quickly pinpoint errors in massive log files on Linux by using dynamic viewing commands such as tail and head, extracting line numbers with grep, searching within time ranges using sed, counting matches, highlighting results, and navigating logs with pagination tools like more and less.
This article explains how to enable Kubernetes audit logging, analyzes CDK‑based attack behaviors captured in audit logs, provides concrete detection rules for information collection, exploitation, and privilege escalation, and shares practical lessons learned when deploying audit‑driven security in cloud‑native environments.
Learn how to efficiently locate error entries in huge log files by combining tail, head, grep, sed, and pagination commands, extracting specific line numbers, time ranges, occurrence counts, and highlighted matches with context for faster debugging.
Learn how to efficiently navigate, filter, and extract specific entries from large log files using tail, head, grep, sed, and pagination commands, with practical examples for locating error lines and time ranges.
This guide shows how to efficiently locate errors in massive server logs using Linux commands like tail, cat, grep, sed, and navigation shortcuts, providing step‑by‑step techniques for dynamic viewing, time‑range searches, keyword filtering, and paginated inspection.
This guide shows programmers how to quickly locate errors in massive server logs using essential Linux commands such as tail, cat, grep, sed, and pagination tools, providing step‑by‑step examples and tips for efficient debugging.
This article explains how NetEase Games leveraged AI, big data, and machine learning to create an AIOps platform that automates anomaly detection, log analysis, and fault localization, improving quality assurance, cost management, and operational efficiency across complex gaming infrastructures.
This guide presents a comprehensive collection of AWK, grep, sed, and netstat one‑liners that let you count unique IPs, rank page visits, measure bandwidth, monitor TCP states, and extract detailed traffic patterns from Apache access logs on Linux systems.
This guide explains how to identify signs of a Linux system intrusion by examining key logs, verifying user account files, monitoring login events, analyzing network traffic, and using lsof to recover deleted security logs, providing step‑by‑step command examples for each task.
HoloInsight is an open‑source, cloud‑native observability platform derived from Ant Group's AntMonitor, offering integrated log‑based monitoring, business metric analysis, and AI‑driven AIOps capabilities while providing a lightweight, modular architecture and extensive extensibility for modern software stacks.
This article presents an AI‑enhanced operations framework that combines metric anomaly detection, alarm compression, log anomaly detection, and intelligent analysis using machine learning methods such as DBSCAN clustering, SARIMAX modeling, Apriori association rules, and LSTM‑based log parsing to improve fault detection and reduce operational costs.
Based on a DTCC2022 presentation, this article explains Apache Doris's high‑performance MPP architecture, its cloud‑native extensions in SelectDB, and how they solve large‑scale log storage and analysis with superior write throughput, storage efficiency, and interactive query speed.
This guide explains how to detect traffic attacks on a low‑traffic Linux website, split Nginx logs daily, identify IPs with excessive requests, and automatically block them using iptables rules scheduled via cron, complete with ready‑to‑run Bash scripts and common firewall commands.
This guide outlines eleven practical steps for Linux system administrators to identify signs of compromise—such as missing logs, altered password files, unusual login activity, abnormal traffic, and deleted files—and provides command examples for detection and recovery.
This article walks through how an online education operator uses Tencent Cloud Log Service to monitor Cloud Connect Network flow logs, set reject‑traffic alerts, analyze regional, IP, and protocol distributions, track bandwidth trends, and finally expand bandwidth to eliminate service interruptions.
A comprehensive collection of practical Linux one‑liners—using awk, grep, sort, uniq, and netstat—to count unique IPs, track page visits, rank URLs, monitor connection states, and measure traffic from Apache access logs for effective server operations.
This article explains why Nginx logs are critical, compares various log‑analysis tools, provides detailed installation and configuration steps for GoAccess, discusses selection criteria, and shares real‑world case studies that demonstrate how to extract valuable system and business insights from massive access logs.
This article walks through the step‑by‑step transformation of a simple online supermarket from a monolithic web app to a fully‑featured microservice architecture, covering common pitfalls, component choices, monitoring, tracing, logging, service discovery, fault‑tolerance, testing, and deployment strategies.
This guide compiles practical Linux shell commands for extracting IP counts, page visit frequencies, time‑range queries, bandwidth usage, HTTP status distribution, and TCP connection states from Apache or Nginx access logs, helping administrators quickly spot traffic patterns, bottlenecks, and potential attacks.
This guide compiles a comprehensive set of Linux command‑line techniques—using awk, grep, netstat, and other tools—to help you count unique IPs, track page visits, identify heavy‑traffic files, monitor connection states, and extract performance metrics from Apache and other web server logs.
The article reviews log‑based, manual, and automated app speed evaluation methods, highlights their trade‑offs, and introduces LazyPerf—a platform that records real‑device interactions, uses resilient widget addressing and built‑in frame detection to dramatically cut automation scripting and calibration effort while improving scalability of performance testing.
This article describes NetEase's AIOps journey for game operations, explaining the Gartner definition of intelligent operations, the implementation roadmap, detailed anomaly‑detection techniques for business, performance, and log data, and a comprehensive fault‑localization workflow that combines resource, code, and historical analysis.
This article investigates why DBLE repeatedly logs "no handler" messages by analyzing DBLE and MySQL logs, using Arthas to trace the call chain, reproducing the scenario with timeout settings, capturing network traffic, and explaining the MySQL 8.0.24 error‑packet behavior that leads to the observed logs.
This article examines security challenges encountered in JD Logistics' sorting platform, details the investigative process for abnormal API requests, proposes a SHA‑256 based authentication scheme with digital signatures, compares industry‑wide API protection methods, and shares practical insights from the author's experience in financial API gateway design.
This article explains how to build a comprehensive monitoring system using the concise USE (Utilization, Saturation, Errors) method, outlines key system and application metrics, and demonstrates practical implementation with Prometheus, Grafana, full‑link tracing, and ELK for observability and performance troubleshooting.
This guide outlines practical steps for Linux system administrators to identify signs of compromise by examining logs, user accounts, login events, network traffic, and recovering deleted files, providing command examples for each investigative task.
The article describes how Ctrip built and continuously improved a Trace system for its ticket‑front‑end microservices, detailing the challenges of distributed logs, the architecture of the solution, and the functional features such as friendly search, multi‑platform aggregation, page replay, and one‑click mock that together boost debugging efficiency for both developers and non‑technical operators.
This article presents seven ready‑to‑use Bash scripts that demonstrate parallel host querying, process statistics gathering, file renaming, directory management, log analysis, network request monitoring, and file size sorting, each with complete code and step‑by‑step explanations.
This article presents a collection of practical Linux shell commands—primarily using awk, grep, sort, uniq, netstat, and tcpdump—to count unique IPs, identify most‑visited pages, filter logs by time or URL, monitor connection states, and calculate traffic statistics for Apache or other web servers.
This guide compiles a comprehensive set of Linux shell commands for analyzing Apache access logs, helping you count unique IPs, identify popular pages, detect suspicious traffic, monitor connection states, measure bandwidth, and extract detailed usage statistics for effective server operations.
This article details the challenges, design choices, deployment steps, detection model creation, data processing, visualization, and future plans of JD Daojia's security operations platform, highlighting the use of Graylog, Elasticsearch, and MongoDB to achieve scalable, real‑time threat detection and response.
This article explains a two‑stage streaming log classification system that uses a prefix‑tree and longest‑common‑subsequence matching to generate log templates, handles traceback logs and cold‑start issues, and combines statistical unsupervised methods to detect anomalies while reducing false alarms.
Learn how to install Kibana, connect it to Elasticsearch, configure index patterns, explore data with Discover, craft queries using Lucene syntax, create visualizations and dashboards, and monitor your stack, all with step‑by‑step guidance and practical examples.
This document describes the background, problems, requirements, analysis, and detailed design of a high‑performance, highly available, and scalable log‑analysis pipeline for MySQL that leverages Kafka, ClickHouse, MySQL, and custom services to aggregate, enrich, and visualize massive query logs.
This article explains how integrating Alibaba Cloud's Log Service (SLS) with the Codeup code‑hosting platform creates a seamless log‑to‑source link, enabling developers and operators to quickly pinpoint problematic code in microservice environments without manual repository setup or local downloads.
This guide presents a comprehensive collection of Linux command‑line techniques—including awk, grep, and netstat—to help you analyze web server logs, identify unique visitors, track page popularity, monitor connection states, and detect performance bottlenecks in a systematic way.
This guide walks through setting up an ELK stack to collect, parse, and visualize Nginx access logs, covering Logstash configuration, Grok patterns, Elasticsearch setup, Nginx proxy with basic authentication, and creating Kibana dashboards for log analysis.
This guide outlines ten practical methods for Linux system administrators to identify signs of intrusion, from missing logs and altered password files to unusual network traffic and recovering deleted log files using process file descriptors.
This step‑by‑step guide shows how to collect, parse, and visualize Nginx access logs using the ELK stack, configure Logstash pipelines, set up Elasticsearch indices, proxy Kibana through Nginx, and secure access with HTTP basic authentication.
This comprehensive guide walks security engineers through every phase of an incident response—from initial information gathering, containment, and vulnerability scanning to detailed log, process, and account analysis, culminating in recovery steps and post‑incident hardening recommendations.
This guide compiles a comprehensive set of Linux shell commands that let you examine web server logs, count unique IPs, identify top‑requested pages, filter bots, monitor connection states, and spot performance or security anomalies, helping you keep your site secure and performant.
Baidu’s Fengjing monitoring platform tackles the daunting challenge of pinpointing failures in its massive Java‑based microservice ecosystem by employing a non‑intrusive probe that captures log metadata, stores it in a database, and reconstructs full request‑level logs with minimal storage overhead.
This guide explains how Sentry’s search uses key:value tokens, optional raw text, logical operators, grouping, exclusions, wildcards, tag syntax, and saved searches, providing step‑by‑step examples for building precise issue and event queries.
The Shenzhen Elasticsearch technical event, co‑hosted by the Elastic Chinese community and Tencent Cloud, presented practical sessions on optimizing the Elastic Stack for search, real‑time analytics, logging, security and APM, featuring compression encoding, MongoDB fusion, ByteDance extensions, cost‑effective log storage, Lucene indexing, cross‑cluster replication, vector engine integration, and large‑scale case studies from Tencent, Tiptop Data and vivo.
This article examines frequent HBase RegionServer failures caused by long GC pauses, oversized scans, and HDFS decommissioning, outlines step‑by‑step troubleshooting procedures—including log searches, GC tuning, scan size limits, and monitoring strategies—and provides practical solutions to prevent and resolve these issues.
This article explores the challenges of log aggregation in micro‑service architectures, introduces a globally unique log identifier (logid) with its required properties, compares various logid generation schemes, and presents end‑to‑end solutions for log distribution, aggregation, and analysis using custom tools such as ylog and watcher.
The article introduces the command‑line utility q, explains how to install it on Linux and Windows, and demonstrates using familiar SQLite‑style SQL queries to search, filter, join, and aggregate log files and command output, offering a convenient alternative to traditional shell tools.
This article introduces the command‑line utility q, explains how to install it on Linux and Windows, and demonstrates using full SQLite‑compatible SQL syntax to query, filter, join, and aggregate plain‑text log files, offering a database‑style alternative to traditional shell tools.
This article explains why large‑scale Elasticsearch clusters may miss log entries during keyword searches, dives into the fundamentals of inverted indexes and tokenization, and demonstrates practical index‑time and query‑time tokenizer optimizations—including custom analyzers for English and Chinese—to dramatically improve search recall and precision.
This article walks you through installing and configuring the open‑source WAF‑FLE console—written in PHP—to collect, search, and visualize ModSecurity logs on Apache or Nginx, covering environment setup, database creation, sensor configuration, and troubleshooting common integration issues.
This article explains how to extend a performance testing framework to record and visualize individual HTTP interface latencies by parsing consolidated logs, grouping timings by URL, and using a Groovy script with StatisticsUtil to generate response‑time charts.
This article explains how the HBase hbck tool verifies region consistency and table integrity, lists the most frequently used hbck commands, and describes both low‑risk and high‑risk repair procedures, including handling of RIT states and log‑based troubleshooting.
This guide compiles twenty practical Linux command-line techniques for analyzing web server logs, revealing visitor IP counts, page popularity, request timing, bandwidth usage, error rates, and connection states, enabling administrators to monitor traffic, detect anomalies, and optimize performance.
This guide presents a comprehensive set of Bash and AWK one‑liners for analyzing web server logs, counting unique IPs, tracking page visits, sorting traffic by time, identifying heavy‑weight requests, monitoring Apache processes, and examining network connection states, helping you detect anomalies and optimize performance.
This guide compiles a series of practical Linux one‑liners—using awk, grep, sort, netstat, and related tools—to count unique IPs, rank page requests, filter bots, monitor connection states, and measure bandwidth, enabling quick forensic analysis of Apache or Nginx access logs.
With the shift from monolithic to distributed architectures, this article compares log‑based and network‑data‑based monitoring across data sources, precision, monitoring paths, and implementation methods, concluding that network‑data monitoring offers superior real‑time insight, lower cost, and faster deployment for full‑link observability.
Xianyu’s new Message Quality Platform links client, API, and server logs by a unique messageId, cleans and clusters real‑time telemetry, correlates user behavior, and visualizes abnormal nodes, giving end‑to‑end traceability that cuts incident investigation time by over 90 % and can be applied to other pipelines.
This article demonstrates how red‑team methods can be applied to phishing traceability, detailing phishing classifications, email‑header extraction, malicious site analysis, web‑shell decryption, privilege‑escalation techniques, log mining, and attacker attribution to reconstruct the full attack chain.
This article outlines a request log analysis system that records core request fields, adds proxy‑related data, derives IP‑based ASN and geographic information, parses user‑agent details, and provides comprehensive metrics such as PV/QPS, UV, traffic, latency, status monitoring, and business‑specific insights, all visualized via an ELK‑Kafka architecture.
This article explains practical methods for detecting account security threats—such as blacklisted, expired, or abnormal login behaviors—by analyzing Linux and Windows login logs, defining detection rules, and leveraging automated tools to generate timely alerts and reduce security risks.
This article reviews how major Chinese companies such as JD.com, Ctrip, Quark, 58.com, and Didi have adopted Elasticsearch for large‑scale search, log analysis, and real‑time analytics, detailing their cluster architectures, scaling strategies, and operational practices.
This article explains what MySQL binlog is, how to enable row‑based logging, and provides step‑by‑step Linux commands using mysqlbinlog and grep to extract historical SQL statements such as DELETE operations for troubleshooting and debugging purposes.
This guide explains how to retrieve Hadoop/YARN application logs using the History Server UI, Yarn command‑line tools, and direct HDFS log access, including commands for listing applications, fetching specific logs, and locating the remote log directory.
This article outlines common intrusion signs on CentOS 6.9 systems, explains how to examine logs, user files, login records, network traffic, and demonstrates using lsof and /proc to recover deleted security logs, providing practical commands for Linux security engineers.
This guide explains why Linux is essential for software testers, outlines how to build test environments, use key commands like tail, grep, top, and vmstat for log analysis and performance monitoring, and offers tips for deeper Linux learning and interview preparation.
This tutorial walks backend engineers through real‑world scenarios of log collection, parsing, and analysis using the ELK stack—Logstash, Elasticsearch, and Kibana—showing configuration examples, Grok patterns, RESTful API queries, aggregations, and visualizations to boost operational efficiency.
This article explains why front‑end error logging is essential, how BadJS (JavaScript runtime errors) are captured, enriched, and reported, and provides practical strategies for analyzing logs, handling Script errors, dealing with hybrid WebView environments, and scaling the system with big‑data pipelines.
This comprehensive guide explains why monitoring is essential for operations, outlines monitoring goals and methods, reviews a wide range of open‑source tools, details a Zabbix‑based workflow, enumerates key metrics across hardware, system, application, network, security and business layers, and offers practical alerting and interview tips.
The article explains why loading all log data into a database is impractical, outlines three drawbacks—volatile requests, data bloat, and cost—and introduces the lightweight awk tool with concrete command examples to filter and analyze network logs efficiently without a database.
This guide shows how to generate hourly slow‑query reports from MySQL slow‑log files by using pt‑query‑digest’s timeline feature, filtering with sed, importing the data into SQLite with termsql, and then querying the results to identify hotspot periods and recurring patterns.
This tutorial walks you through installing the GD library, building SARG from source, configuring its key parameters, running reports, using command‑line options, scheduling automated jobs with cron, and troubleshooting common installation and configuration issues for Squid log analysis.
This article presents a modular architecture for real‑time ETL log collection and analysis, detailing the installation and configuration of Flume, Kafka, Storm, Drools, and Redis, and explains how their integration improves fault tolerance, scalability, and processing speed.
When log files grow massive, traditional tools like vim, cat, grep, and awk become slow and memory‑hungry, but Linux’s split command lets you divide a huge file by line count or size, process the pieces individually, and later recombine them, dramatically improving analysis efficiency.
In an interview, Tencent Cloud senior engineer Chen Xi explains how Tencent optimizes Elasticsearch for massive log, monitoring, and document search workloads by prioritizing stability through kernel tweaks, boosting performance with scenario‑specific settings, cutting costs via redundant storage trimming and off‑heap indexing, and leveraging rich data‑pipeline components and robust distributed cluster management to lower operational overhead while anticipating future ecosystem growth and community collaboration.
This guide explains why web log analysis is essential for security, demonstrates how to parse Apache logs, distinguishes normal from malicious requests, and provides practical Secsoso commands for business behavior statistics, traffic monitoring, and detecting attacks such as CC, SQL injection, file inclusion, and XSS.
Monitoring network activity and ensuring compliance requires effective log analysis, and this article reviews five open‑source tools—Graylog, Nagios, Elastic Stack, LOGalyze, and Fluentd—detailing their features, strengths, and use cases for operations and security teams.
