Log Investigation Techniques
Good log investigation is about narrowing the problem fast: identify the time window, find the failing request, extract the stacktrace, remove noise, then group repeating patterns.
Recommended Workflow
- Start with the time window and service name.
- Search for
ERROR,Exception, request ID, transaction ID, username or endpoint. - Use context lines around the match to understand the sequence.
- Summarize duplicate failures to find the main issue.
- Correlate with service restarts, deployments, traffic spikes or database/network events.
Command Reference
| Command | What it does | Example |
|---|---|---|
grep -n 'ERROR' app.log | Finds error lines and shows their line numbers. | grep -n 'ERROR' app.log |
grep -n 'Exception' app.log | Finds exception lines with line numbers. | grep -n 'Exception' app.log |
grep -A 20 -B 5 'NullPointerException' app.log | Shows lines before and after a match for context. | grep -A 20 -B 5 'NullPointerException' app.log |
tail -f app.log | grep -E 'ERROR|WARN' | Follows logs live and filters serious messages. | tail -f app.log | grep -E 'ERROR|WARN' |
sed -n '1200,1260p' app.log | Prints a selected line range from a log. | sed -n '1200,1260p' app.log |
awk '/ERROR|WARN|Exception/' app.log | Prints lines matching multiple patterns. | awk '/ERROR|WARN|Exception/' app.log |
zgrep -n 'ERROR' app.log.gz | Searches inside compressed logs. | zgrep -n 'ERROR' app.log.gz |
grep 'requestId=abc123' app.log | Traces one request or correlation ID through the log. | grep 'requestId=abc123' app.log |
grep '2026-03-08' app.log | Filters lines for a specific date. | grep '2026-03-08' app.log |
grep 'ERROR' app.log | sort | uniq -c | sort -nr | head | Groups repeated errors to spot the main issue. | grep 'ERROR' app.log | sort | uniq -c | sort -nr | head |
What to Look For
- First error before the cascade of follow-up errors
- Retry loops, timeouts and connection refused messages
- Memory or GC pressure before slow responses
- Restart events before or after the failure window
- Common thread names, request IDs or host names