Log files are the oldest form of telemetry and still one of the most useful. Each entry usually has a timestamp, a severity level and a message, and often the source and other context. When something breaks, they are usually the first place engineers look.
What a log entry looks like
A line from a web server access log, in the common "combined" format:
203.0.113.7 - - [10/Oct/2026:13:55:36 +0000] "GET /checkout HTTP/1.1" 500 1534 "-" "Mozilla/5.0"A structured application log entry in JSON, which tools can parse without guessing:
{"time":"2026-10-10T13:55:36Z","level":"error","service":"payments","trace_id":"4bf92f3577b34da6","msg":"card authorization timed out"}Common types of log files
- Application logs: errors, warnings and events written by your code.
- Web server logs: access logs (one line per request) and error logs from Apache, NGINX or IIS. See the Apache error log.
- System logs: syslog or the systemd journal on Linux, the Event Log on Windows.
- Security and audit logs: logins, sudo use, permission changes.
- Database logs: errors and slow query logs.
- Container logs: whatever a container writes to stdout and stderr.
- Cloud logs: provider audit trails such as AWS CloudTrail, and network flow logs.
Formats
Logs are written as plain text, in standard formats such as syslog (RFC 5424) and the Common or Combined Log Format, or as structured JSON. Structured logs are easier to search and analyze, because every field has a name. See structured logging.
Log levels
Most logging libraries tag each entry with a severity: TRACE, DEBUG, INFO, WARN, ERROR and FATAL (names vary). Production systems usually log at INFO or WARN and above, to keep volume down. See log levels explained.
Managing log files
- Rotation: tools like logrotate split and compress logs so they don't fill the disk.
- Retention: keep logs as long as debugging and compliance need, and no longer.
- Centralization: once you have more than a few servers or any containers, logging into each machine to search files stops working. Ship logs to one place for log analysis.
- Privacy: keep passwords, tokens and personal data out of logs, or mask them.
Log files in Atatus
Atatus log management collects log files from servers, containers, web servers and databases, parses them into searchable fields, groups similar lines into patterns and links each line to the trace of the request that produced it.