Log Permissions & Troubleshooting

In a class environment (or on hardened systems), you may not be allowed to read every file under /var/log. That’s normal. The goal is to learn a workflow that still works when some logs are blocked.

When /var/log is blocked, use journal text snapshots

If you cannot read a restricted log file (you may see Permission denied), you can still practice the troubleshooting flow using the provided simulated journal snapshots in ~/playground/chapter9. This is also where sed shines: extract only the important lines.

# Start in the practice folder
cd ~/playground/chapter9

# Pull out error lines (simulates a "show only errors" view)
sed -n '/ERROR/p' journal_after.txt

# Pull out the specific storage-related message
sed -n '/no space left on device/p' journal_after.txt

# Optional: extract from the pre-built errors file
sed -n '/ERROR/p' journal_after_errors.txt

1) Try a Restricted Log File (expect failure)

# This may work, but often you will see "Permission denied"
less /var/log/secure 2>/dev/null || echo "Can't read /var/log/secure"

# You can also check permissions (readable info)
ls -l /var/log/secure 2>/dev/null

2) Use journalctl as a Fallback

If a file under /var/log is blocked, switch to journalctl and filter by service/time.

# Current boot only (often works for non-admin users)
journalctl -b --since "1 hour ago" --no-pager

# Service-specific (replace sshd with your service/unit)
journalctl -u sshd --since "today" --no-pager

# Only errors for that service
journalctl -u sshd -p err..alert --since "today" --no-pager

3) Troubleshooting Flow (small and repeatable)

• Step 1: identify the symptom (what broke: login? web? disk full?)
• Step 2: run a status/read-only check (e.g. systemctl status <service> if you’re allowed)
• Step 3: find the first relevant errors in a narrow time window using journalctl
• Step 4: if the errors mention storage, switch back to the disk workflow: df -h then du

What you might see (examples of messages)

• “no space left on device” → disk is full (use the Disk workflow)
• “failed to start” / “service exited” → check unit logs with journalctl -u
• “permission denied” → file ACL/SELinux/policy issue (permissions lesson comes later in the course)