Hands-on guide series
Logging and Log Management: A Hands-On Guide
A five-part, hands-on guide to logging on a single VPS: how journald and rsyslog fit together and where logs live, structured JSON logs with jq and logrotate, shipping logs to a central rsyslog collector over TCP, querying with journalctl and jq plus a threshold alert, and a retention, masking and compliance policy. Every command tested on a live Ubuntu 24.04 server.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
How Linux Logging Works: journald and rsyslogLinux logging on Ubuntu 24.04, destination-first: one journalctl query finds the failing request, make the journal persistent, then learn journald and rsyslog.9 min - 2
Structured Logging and Log Rotation on LinuxEmit structured logging as JSON and query it with jq on Ubuntu 24.04, then rotate the file with logrotate and cap the journal so neither grows without bound.6 min - 3
Shipping Logs to a Central Server with rsyslogA hands-on guide to shipping logs to a central rsyslog collector over TCP on Ubuntu 24.04, then reading the line back from the store to prove it arrived.6 min - 4
Querying Logs and Log Alerting on LinuxQuery the journal and JSON logs with journalctl and jq, then build log alerting that fires on an error threshold and stays quiet otherwise, tested on Ubuntu 24.04.7 min - 5
Log Retention, Compliance and DPDP BasicsSet a log retention policy on Ubuntu 24.04, mask personal data for DPDP, lock down file permissions, and make an audit trail tamper-evident with append-only.7 min