systemd: journalctl (binary, indexed). Flags: -u <unit> (service), -f (follow), -p err (priority), --since "1 hour ago". Traditional: /var/log/syslog, /var/log/messages (text, rotated by logrotate).

journalctl --since "2024-01-01" --until "2024-01-02" -p err..crit (errors and above). -p 0..3 = emerg/crit/err/warning. --since "1 hour ago".

1. strace -f -e trace=openat,access <cmd> — syscalls. 2. ltrace -f <cmd> — library calls. 3. Run with bash -x script.sh for script tracing. 4. Check exit code: echo $?.

Rotates, compresses, mails, and removes old logs. Config in /etc/logrotate.d/. Key options: daily/weekly, rotate N, compress, delaycompress, missingok, notifempty, create 0640 root adm, postrotate script to reload daemon.

1. GRUB menu → edit kernel line → add systemd.unit=emergency.target or rd.break. 2. In emergency shell: mount /sysroot, chroot /sysroot. 3. Check journalctl -xb, dmesg -T, fsck disks. 4. Fix fstab, initramfs, or grub config.

Port: ss -tulpn | grep :PORT or lsof -i :PORT. File: lsof /path/to/file or fuser -v /path/to/file. Kill with fuser -k /path.

strace -p <PID> -f -e trace=network (attach). strace -f -o output.txt <cmd> (from start). Filters: -e trace=file,network,process. ⚠️ Adds overhead; don't run on high-throughput prod without sampling.