The answer is in the log
A shop's payments stop working at midnight. Nobody touched anything. The first thing the engineer does is read the end of a file where the payment program writes what it did. It says what went wrong, with the time.
By the end of this lesson
Note
I can read a log and stop a process that misbehaves.
Key words
- Log: a file where a program writes what it did.
- Pipe:
|, which hands one command's answer to the next. - Process: a program that is running now.
- PID: the number that names a process.
- Signal: a message sent to a process, such as stop.
Starter: what you already know
Note
Answer in your head. 1. What does >> do to a file? 2. What is a path? 3. Which command prints a whole file? You will meet a command for the end of a file only.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, so it takes a little longer to come up than a container. Each Run button types its command into the machine's terminal, one after another in the same session. If one says the machine is still starting, wait a few seconds and press it again. Where the lesson says Type this, the command never ends by itself or asks you something, so press Open terminal on the bar and type it yourself.
Read the end of a log, and search it
The end of a log is the newest part. tail -n 5 prints the last five lines. grep prints only the lines that contain some words, and -c counts them instead. The last command joins three with pipes: read the whole log, keep the hello lines, show the three newest.
tail -n 5 /var/log/test.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
grep 'hello' /var/log/test.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
grep -c ERROR /var/log/test.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
cat /var/log/test.log | grep 'hello' | tail -n 3Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Type this: follow a log as it grows
In the terminal, type tail -f /var/log/test.log. New lines appear as they are written. Press Ctrl+C to stop. A Run button cannot press Ctrl+C, so you type this one. You will also see tail -200f in other people's notes: it shows the last 200 lines first and then follows.
Check
Tip
Which command shows only the end of a file, and which keeps only the lines with a word in them? Answer: tail and grep. Joined by a pipe they answer most questions about a log.
Find a file, and a command
find / -name 'test.log' searches the whole machine. Parts of it are off limits to you, so 2>/dev/null throws those error messages away. which ls says where a command lives.
find / -name 'test.log' 2>/dev/nullShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
which lsShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Find a process
A running program is a process and has a number, its PID. ps -ef lists them all, and | grep worker keeps the lines with that word. Two lines come back: the worker, and the grep you just ran. pgrep -f lab-worker prints only the number.
ps -ef | grep workerShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
pgrep -f lab-workerShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Type this: stop it
Take the number from the answer above. In the terminal, type kill 1234, using your number, then run ps -ef | grep worker again: the worker has gone. Now find the second process with ps -ef | grep stubborn, type kill and its number, and look again. It is still there, because it ignores a polite request. Type kill -9 and its number, and it stops. top shows the busiest processes live; press q.
A common mistake
Warning
Many people think kill -9 is simply the stronger kill and use it first. kill asks a program to finish, so it can save its work and tidy up. kill -9 takes it away at once with no tidying, and can leave half-written files. Use kill, wait a few seconds, and use -9 only when the program still will not stop.
Exit check
Tip
Answer without looking back. 1. How do you stop tail -f? 2. What does 2>/dev/null do? 3. Which do you try first, kill or kill -9? Answers: Ctrl+C; throws away the error messages; kill.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own, and a Run types into its terminal and shows what it printed. Key learning points: 1. tail and grep read a log. 2. find and which locate things. 3. ps finds a process and kill stops it. Common mistake: using kill -9 first. Equipment: the lab and a browser. Tip: start tail -f on the teacher screen and have the class say when the next line will come. The lab has no check and marks nothing; set a hand-in of your own if you want one. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.