5.1 Journal Status / Disk Usage (+ Available Boots & Storage Type)
5.2 Current Boot Errors (Journalctl -p err)
5.3 Current Boot Warnings (Journalctl -p warning)
5.4 Kernel Errors (dmesg & Journalctl -k)
5.5 Authentication Logs (SSH, Sudo & Auth Activity)
5.6 Recent Reboots / Shutdowns (+ Boot Time)
5.7 OOM Events (Out Of Memory Triggers)
5.8 Storage / Filesystem Errors (SCSI, NVMe, Ext4/XFS faults)
5.9 Network Errors (Link Drops, NIC Resets & Watchdogs)
5.10 Service Failures (Detailed Daemon Crashes)
5.11 Log Rotation (Configs, Status & Timers)
5.12 Large Log Files (Top 20 Hunt)
5.13 Recently Modified Logs (Last 60 Minutes)
Copy–>Past
echo "==================== 05. LOGS & JOURNAL ===================="; printf "\n"; echo "5.1 JOURNAL STATUS / DISK USAGE"; if command -v journalctl >/dev/null 2>&1; then echo "--- Journal Disk Usage ---"; journalctl --disk-usage 2>/dev/null || echo "Journal disk usage unavailable"; printf "\n"; echo "--- Available Boots ---"; journalctl --list-boots --no-pager 2>/dev/null | tail -20 || echo "Boot journal history unavailable"; printf "\n"; echo "--- Journal Storage ---"; if [ -d /var/log/journal ]; then echo "Persistent journal storage: enabled"; du -sh /var/log/journal 2>/dev/null; else echo "Persistent journal storage: not detected"; echo "Journal may be stored only in /run/log/journal"; fi; else echo "journalctl not available"; fi; printf "\n%.0s" {1..3}; echo "5.2 CURRENT BOOT ERRORS"; if command -v journalctl >/dev/null 2>&1; then journalctl -b 0 -p err --no-pager 2>/dev/null | tail -50; else echo "journalctl not available"; fi; printf "\n%.0s" {1..3}; echo "5.3 CURRENT BOOT WARNINGS"; if command -v journalctl >/dev/null 2>&1; then journalctl -b 0 -p warning --no-pager 2>/dev/null | tail -50; else echo "journalctl not available"; fi; printf "\n%.0s" {1..3}; echo "5.4 KERNEL ERRORS"; echo "--- dmesg Critical Errors ---"; if command -v dmesg >/dev/null 2>&1; then dmesg -T --level=err,crit,alert,emerg 2>/dev/null | tail -40 || echo "dmesg unavailable or access restricted"; else echo "dmesg not available"; fi; printf "\n"; echo "--- Kernel Journal Errors ---"; if command -v journalctl >/dev/null 2>&1; then journalctl -k -b 0 -p err --no-pager 2>/dev/null | tail -40; else echo "journalctl not available"; fi; printf "\n%.0s" {1..3}; echo "5.5 AUTHENTICATION LOGS"; echo "--- Recent SSH / Sudo Activity ---"; if command -v journalctl >/dev/null 2>&1; then journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'sshd|ssh.service|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "No recent SSH or sudo activity found"; else tail -n 100 /var/log/auth.log /var/log/secure 2>/dev/null | grep -Ei 'sshd|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "Authentication logs unavailable"; fi; printf "\n%.0s" {1..3}; echo "5.6 RECENT REBOOTS / SHUTDOWNS"; echo "--- Reboots ---"; last reboot 2>/dev/null | head -20 || echo "Reboot history unavailable"; printf "\n"; echo "--- Shutdowns ---"; last shutdown 2>/dev/null | head -20 || echo "Shutdown history unavailable"; printf "\n"; echo "--- Current Boot Time ---"; who -b 2>/dev/null || echo "Current boot time unavailable"; printf "\n%.0s" {1..3}; echo "5.7 OOM EVENTS"; if command -v journalctl >/dev/null 2>&1; then journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' | tail -40 || echo "No OOM events found in current boot"; else grep -Eih 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' /var/log/messages /var/log/syslog 2>/dev/null | tail -40 || echo "No OOM events found"; fi; printf "\n%.0s" {1..3}; echo "5.8 STORAGE / FILESYSTEM ERRORS"; if command -v journalctl >/dev/null 2>&1; then journalctl -k -b 0 --no-pager 2>/dev/null | grep -Ei 'I/O error|buffer I/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"; else dmesg 2>/dev/null | grep -Ei 'I/O error|buffer I/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"; fi; printf "\n%.0s" {1..3}; echo "5.9 NETWORK ERRORS"; if command -v journalctl >/dev/null 2>&1; then journalctl -k -b 0 --no-pager 2>/dev/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"; else dmesg 2>/dev/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"; fi; printf "\n%.0s" {1..3}; echo "5.10 SERVICE FAILURES"; if command -v journalctl >/dev/null 2>&1; then journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'failed to start|failed with result|main process exited|control process exited|start request repeated too quickly|scheduled restart job|dependency failed for|entered failed state' | tail -60 || echo "No service failure events found"; else echo "journalctl not available"; fi; printf "\n%.0s" {1..3}; echo "5.11 LOG ROTATION"; echo "--- Logrotate Package / Binary ---"; if command -v logrotate >/dev/null 2>&1; then logrotate --version 2>/dev/null | head -1; else echo "logrotate not installed"; fi; printf "\n"; echo "--- Logrotate Configuration ---"; ls -la /etc/logrotate.conf /etc/logrotate.d/ 2>/dev/null || echo "Logrotate configuration unavailable"; printf "\n"; echo "--- Logrotate Status ---"; ls -la /var/lib/logrotate/status /var/log/logrotate /var/log/logrotate.log 2>/dev/null || echo "Logrotate status file or execution log unavailable"; printf "\n"; echo "--- Logrotate Timer / Service ---"; systemctl status logrotate.timer logrotate.service --no-pager 2>/dev/null | head -40 || echo "Logrotate systemd units unavailable"; printf "\n%.0s" {1..3}; echo "5.12 LARGE LOG FILES"; find /var/log -xdev -type f -printf '%s %p\n' 2>/dev/null | sort -nr | head -20 | awk '{ size=$1; $1=""; printf "%10.2f MiB %s\n", size/1024/1024, substr($0,2) }' || echo "Unable to inspect /var/log"; printf "\n%.0s" {1..3}; echo "5.13 RECENTLY MODIFIED LOGS"; find /var/log -xdev -type f -mmin -60 -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null | sort -r | head -40 || echo "No logs modified during the last hour"
# ==================== 05. LOGS & JOURNAL ====================
echo "==================== 05. LOGS & JOURNAL ===================="
printf "\n"
# --- 5.1 JOURNAL STATUS / DISK USAGE ---
echo "5.1 JOURNAL STATUS / DISK USAGE"
if command -v journalctl >/dev/null 2>&1; then
echo "--- Journal Disk Usage ---"
journalctl --disk-usage 2>/dev/null || echo "Journal disk usage unavailable"
printf "\n"
echo "--- Available Boots ---"
journalctl --list-boots --no-pager 2>/dev/null | tail -20 || echo "Boot journal history unavailable"
printf "\n"
echo "--- Journal Storage ---"
if [ -d /var/log/journal ]; then
echo "Persistent journal storage: enabled"
du -sh /var/log/journal 2>/dev/null
else
echo "Persistent journal storage: not detected"
echo "Journal may be stored only in /run/log/journal"
fi
else
echo "journalctl not available"
fi
printf "\n%.0s" {1..3}
# --- 5.2 CURRENT BOOT ERRORS ---
echo "5.2 CURRENT BOOT ERRORS"
if command -v journalctl >/dev/null 2>&1; then
journalctl -b 0 -p err --no-pager 2>/dev/null | tail -50
else
echo "journalctl not available"
fi
printf "\n%.0s" {1..3}
# --- 5.3 CURRENT BOOT WARNINGS ---
echo "5.3 CURRENT BOOT WARNINGS"
if command -v journalctl >/dev/null 2>&1; then
journalctl -b 0 -p warning --no-pager 2>/dev/null | tail -50
else
echo "journalctl not available"
fi
printf "\n%.0s" {1..3}
# --- 5.4 KERNEL ERRORS ---
echo "5.4 KERNEL ERRORS"
echo "--- dmesg Critical Errors ---"
if command -v dmesg >/dev/null 2>&1; then
dmesg -T --level=err,crit,alert,emerg 2>/dev/null | tail -40 || echo "dmesg unavailable or access restricted"
else
echo "dmesg not available"
fi
printf "\n"
echo "--- Kernel Journal Errors ---"
if command -v journalctl >/dev/null 2>&1; then
journalctl -k -b 0 -p err --no-pager 2>/dev/null | tail -40
else
echo "journalctl not available"
fi
printf "\n%.0s" {1..3}
# --- 5.5 AUTHENTICATION LOGS ---
echo "5.5 AUTHENTICATION LOGS"
echo "--- Recent SSH / Sudo Activity ---"
if command -v journalctl >/dev/null 2>&1; then
journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'sshd|ssh.service|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "No recent SSH or sudo activity found"
else
tail -n 100 /var/log/auth.log /var/log/secure 2>/dev/null | grep -Ei 'sshd|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "Authentication logs unavailable"
fi
printf "\n%.0s" {1..3}
# --- 5.6 RECENT REBOOTS / SHUTDOWNS ---
echo "5.6 RECENT REBOOTS / SHUTDOWNS"
echo "--- Reboots ---"
last reboot 2>/dev/null | head -20 || echo "Reboot history unavailable"
printf "\n"
echo "--- Shutdowns ---"
last shutdown 2>/dev/null | head -20 || echo "Shutdown history unavailable"
printf "\n"
echo "--- Current Boot Time ---"
who -b 2>/dev/null || echo "Current boot time unavailable"
printf "\n%.0s" {1..3}
# --- 5.7 OOM EVENTS ---
echo "5.7 OOM EVENTS"
if command -v journalctl >/dev/null 2>&1; then
journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' | tail -40 || echo "No OOM events found in current boot"
else
grep -Eih 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' /var/log/messages /var/log/syslog 2>/dev/null | tail -40 || echo "No OOM events found"
fi
printf "\n%.0s" {1..3}
# --- 5.8 STORAGE / FILESYSTEM ERRORS ---
echo "5.8 STORAGE / FILESYSTEM ERRORS"
if command -v journalctl >/dev/null 2>&1; then
journalctl -k -b 0 --no-pager 2>/dev/null | grep -Ei 'I/O error|buffer I/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"
else
dmesg 2>/dev/null | grep -Ei 'I/O error|buffer I/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"
fi
printf "\n%.0s" {1..3}
# --- 5.9 NETWORK ERRORS ---
echo "5.9 NETWORK ERRORS"
if command -v journalctl >/dev/null 2>&1; then
journalctl -k -b 0 --no-pager 2>/dev/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"
else
dmesg 2>/dev/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"
fi
printf "\n%.0s" {1..3}
# --- 5.10 SERVICE FAILURES ---
echo "5.10 SERVICE FAILURES"
if command -v journalctl >/dev/null 2>&1; then
journalctl -b 0 --no-pager 2>/dev/null | grep -Ei 'failed to start|failed with result|main process exited|control process exited|start request repeated too quickly|scheduled restart job|dependency failed for|entered failed state' | tail -60 || echo "No service failure events found"
else
echo "journalctl not available"
fi
printf "\n%.0s" {1..3}
# --- 5.11 LOG ROTATION ---
echo "5.11 LOG ROTATION"
echo "--- Logrotate Package / Binary ---"
if command -v logrotate >/dev/null 2>&1; then
logrotate --version 2>/dev/null | head -1
else
echo "logrotate not installed"
fi
printf "\n"
echo "--- Logrotate Configuration ---"
ls -la /etc/logrotate.conf /etc/logrotate.d/ 2>/dev/null || echo "Logrotate configuration unavailable"
printf "\n"
echo "--- Logrotate Status ---"
ls -la /var/lib/logrotate/status /var/log/logrotate /var/log/logrotate.log 2>/dev/null || echo "Logrotate status file or execution log unavailable"
printf "\n"
echo "--- Logrotate Timer / Service ---"
systemctl status logrotate.timer logrotate.service --no-pager 2>/dev/null | head -40 || echo "Logrotate systemd units unavailable"
printf "\n%.0s" {1..3}
# --- 5.12 LARGE LOG FILES ---
echo "5.12 LARGE LOG FILES"
find /var/log -xdev -type f -printf '%s %p\n' 2>/dev/null | sort -nr | head -20 | awk '{ size=$1; $1=""; printf "%10.2f MiB %s\n", size/1024/1024, substr($0,2) }' || echo "Unable to inspect /var/log"
printf "\n%.0s" {1..3}
# --- 5.13 RECENTLY MODIFIED LOGS ---
echo "5.13 RECENTLY MODIFIED LOGS"
find /var/log -xdev -type f -mmin -60 -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null | sort -r | head -40 || echo "No logs modified during the last hour"
