Tag: logging

Your Loki volume hit tens of GB and you don't know why. Find the noisy streams with logcli and LogQL, then trim them in Alloy and set per-stream retention.

journald already stores structured key/value log fields. Learn to write custom fields, query them, and ship logs to one box before reaching for Loki or ELK.

Vector vs Fluent Bit log shippers: Rust-based transforms and sinks vs lightweight C agent. Config, VRL, footprint, and when each wins.

Promtail vs Vector: which log shipping agent fits your setup? Loki's purpose-built simplicity or Vector's transform power and multiple sinks.

ClickHouse can store TB of logs on one node, query in seconds, and outscale Loki and Elasticsearch in raw cost. Here's how to wire it up with Vector and Grafana.

ELK does everything and wants all your memory. Loki does logging the Prometheus way, label indexes, not content, and runs on a fraction of the resources. Here's the honest comparison.

One app logging to one file becomes a 50GB disk emergency. logrotate config, size-based rotation, Docker log driver limits, and app-level log control.

Learn Docker logging from basics to centralized stacks. Master docker logs, logging drivers, log rotation, Loki+Grafana, and Fluentd setup with practical examples.

Set up auditd to log every sudo command and file change on Linux: auditctl rules, ausearch, aureport, and shipping logs to Loki or Elasticsearch for compliance.

auditd logs every system call, file access, and command run on your Linux server. Learn ausearch, aureport, and how to write audit rules that catch it.

awk is perfect for parsing logs. 5 patterns for filtering, summing, counting, splitting fields, and reformatting, no Perl or Python required.

Essential journalctl commands: -u, -f, --since, -p, -k, -b, --no-pager, JSON output. The queries you need on a broken server at 2 AM.