Guides

Investigate a suspected account takeover from your logs: scope sessions and IPs, build the timeline, contain, check what was accessed, and notify.

Turn on Application Load Balancer access logs, set the S3 bucket policy, read each field in an entry, and query the files with Athena or awk.

Better Stack list prices by data region: responder seats, bundles, per-GB log ingestion and retention, uptime and status pages. Checked 8 Nov 2026.

A new CVE is public. Decide if it is worth a hunt, set the log window, search with zgrep and jq, and separate failed attempts from real compromise.

Read CloudTrail events, pivot from a key, user, or IP, and run Logs Insights and Athena queries for failed logins, new keys, StopLogging, and secret reads.

Learn the CloudWatch Logs Insights query language: fields, filter, parse, stats, sort, dedup, and bin, with worked examples, scan cost and limits.

Amazon CloudWatch list prices for logs, metrics, alarms and dashboards in US East (N. Virginia), with a worked monthly example. Checked 8 Nov 2026.

An npm package you use was backdoored. Check lockfiles, CI logs, and dev machines, see if install scripts ran, rotate exposed secrets, and rebuild clean.

Datadog pricing explained with list prices for hosts, logs, APM and custom metrics, plus a worked monthly example. Checked November 8, 2026.

Configure the Django LOGGING setting for production: JSON to stdout, per-logger levels, a request ID on every line, and what django.request actually logs.

Dynatrace list prices for hosts, logs, metrics, traces and AI units under a Platform Subscription, plus a worked month. Checked 8 Nov 2026.

Find failed SSH login attempts in auth.log or journald, count them by IP, spot a success after failures, and harden sshd with key-only auth and fail2ban.

How the GitHub audit log works: search qualifiers, REST API, streaming, 180-day retention, and queries for repo visibility, deploy keys, and role changes.

Use Go's log/slog for structured logging: JSON handler, dynamic levels, request and trace IDs from context, redaction, and OpenTelemetry export.

Query Google Cloud logs with the Logs Explorer query language and gcloud logging read, read Cloud Run logs, and route logs with sinks.

Grafana Cloud pricing explained: $19 platform fee, $6.50 per 1k metric series, logs at $0.05 process and $0.40 write per GB, plus an example. Nov 2026.

How Honeycomb prices by events, not bytes: Free and Pro limits, the $3.00 per million event rate, overage rules and a worked month. Checked 8 Nov 2026.

What a web shell leaves in access logs, on disk, and in the process tree, with commands to find one, and how to respond once you have.

Read Kubernetes pod logs with kubectl logs: follow, previous container, multi-container pods, selectors, time filters, node log paths, and forwarding.

Configure the awslogs driver or FireLens for ECS tasks, find the log stream for a task, tail it from the CLI, and fix the usual reasons logs are missing.

Read Railway build, deploy, HTTP, and DNS logs in the dashboard and with the railway logs CLI, use the filter syntax, and keep logs past retention.

Where Lambda logs live, how to read them in the console and with aws logs tail, query them with Logs Insights, and what to check when they are missing.

Read Heroku logs with heroku logs --tail, filter by source and dyno, understand Logplex limits and the log format, and keep logs longer with log drains.

Find build and runtime logs on Vercel, filter them in the dashboard, query them with the vercel logs CLI, and forward them with a log drain.

Use journalctl to follow logs, filter by unit, priority, boot, and time, output JSON, and cap journal disk usage. Flags checked against the man page.

How to log in JSON: one object per line, a stable field schema, UTC timestamps, trace IDs, safe error fields, with Go, Python, and Node examples.

Turn on Kubernetes audit logs on EKS, GKE, or a self-managed cluster, then use jq to find pod exec, secret reads, RBAC changes, and anonymous requests.

A GitHub, Stripe, or OpenAI key was exposed. Revoke it, find where it leaked in git, CI, and client bundles, and check the provider audit log for misuse.

An AWS access key leaked. Deactivate it, see what it did in CloudTrail by AccessKeyId, read GuardDuty findings, and rotate without breaking production.

Head, tail, and rate-limit log sampling explained, with tested nginx, Python, and OpenTelemetry Collector configs that keep every error and audit event.

Practical logging best practices: what to log, consistent levels, structured fields, context IDs, keeping secrets out, sampling, rotation, and retention.

Write a logrotate config with rotate, compress, maxsize, postrotate, and copytruncate. Test it with -d and -f, and avoid the dateext collision.

How to log across microservices: propagate trace context, put the trace ID in every line, share one schema, and collect logs centrally. Tested example.

Turn on the MySQL slow query log, set long_query_time, log unindexed queries, read the entry fields, summarize with mysqldumpslow, and rotate the file.

New Relic pricing explained: $0.40 per GB data ingest, per-user licenses, Data Plus, compute, plus a worked monthly example. Checked November 8, 2026.

Set up production logging in Next.js: the dev-only logging config, pino in route handlers, instrumentation.ts, onRequestError, request IDs, and trace IDs.

Configure the nginx access log and error log: default paths, log_format with JSON escaping, log levels, conditional logging, syslog, and rotation.

How to log in Node.js: what console does, why to move to structured JSON, how to log Express requests with morgan, and how to choose a logging library.

Set up OpenTelemetry in Node.js: NodeSDK, auto-instrumentation, OTLP exporters, trace IDs in pino or winston logs, ESM, shutdown, and common mistakes.

Set up OpenTelemetry in Python: opentelemetry-instrument, OTLP exporters, the logging handler, trace IDs in JSON logs, manual setup, and common mistakes.

Send logs with OpenTelemetry: the log record data model, bridging Python logging, the Collector filelog receiver, and exporting over OTLP/HTTP.

PCI DSS Requirement 10 for logging: what 10.2 must capture, how to protect and review logs, the 12-month retention rule, time sync, and control failures.

Set up Pino for Node.js: JSON output, readable level labels, child loggers, redaction, transports, pino-http request IDs, and OpenTelemetry trace IDs.

Configure PostgreSQL logging: logging_collector, log_min_duration_statement, log_line_prefix, jsonlog, lock waits, auto_explain, with real output.

Configure Python logging with dictConfig, emit JSON, add request and trace IDs, pick levels, and avoid the common mistakes. Working code for Python 3.

Configure Rails logs for production: log level, STDOUT, request ID tags, a JSON formatter, Rails 8.1 structured events, param filtering, and trace IDs.

Turn on S3 server access logging, choose between S3 and CloudWatch Logs delivery, read the log format, and query it with Athena. Compared with CloudTrail.

Credentials and personal data end up in logs more often than teams expect. Search for them with regexes, rotate before you purge, and redact at the logger.

What to log for security: auth events, access control failures, admin actions, and high-value transactions, with fields, exclusions, integrity and alerts.

Sentry pricing explained: Team at $26 and Business at $80 a month, per-category rates, pay-as-you-go budgets and a worked example. Checked Nov 8, 2026.

Splunk pricing explained: four pricing models, Observability Cloud from $15 per host, which products have public prices and overage rules. Nov 8, 2026.

Set up structlog for production: JSON output, bound context, contextvars request IDs, stdlib integration, OpenTelemetry trace IDs, and traceback pitfalls.

How Sumo Logic prices with credits and Flex: $0 ingest, price per TB scanned from its estimator, plan limits and a worked month. Checked 8 Nov 2026.

Configure the Winston logger in Node.js: JSON formats, levels, transports, error stacks, redaction order, request IDs, and OpenTelemetry trace IDs.