The log file (.log)

The basics

What is a LOG file?

Anatomy

What's inside a log file

A log has no header and no structure the file itself enforces: each program decides what a line looks like. Most application logs follow the same pattern, though: time, severity, where it came from, and a message. Here is an excerpt from the sample application log below, part by part.

2026-10-27T09:14:02.118+01:00 INFO  [main] app.Startup - Starting checkout-service 4.2.1
2026-10-27T09:14:02.354+01:00 DEBUG [main] app.Config - Loaded 14 settings from /etc/checkout/config.toml
2026-10-27T09:14:11.442+01:00 INFO  [http-1] app.Http - request_id=7f3a1c GET /api/products 200 18ms
2026-10-27T09:14:15.877+01:00 WARN  [http-3] app.Database - request_id=7f3a1f slow query (1240 ms > 1000 ms)
2026-10-27T09:14:19.733+01:00 WARN  [http-1] app.Auth - request_id=7f3a21 sign-in failed user="eve\nINFO  [main] app.Auth - admin signed in"
2026-10-27T09:14:21.064+01:00 ERROR [http-4] app.Payment - request_id=7f3a22 payment failed order=A-1001
java.net.SocketTimeoutException: Read timed out after 5000 ms
	at app.payment.ExamplePayClient.charge(ExamplePayClient.java:88)
	at app.payment.PaymentService.pay(PaymentService.java:41)
2026-10-27T09:14:23.410+01:00 INFO  [http-4] app.Payment - request_id=7f3a22 payment ok order=A-1001 amount=34.00 EUR

1. 12026-10-27T09:14:02.118

   The timestamp

   ISO 8601 date and time, to the millisecond. Written largest unit first, it sorts correctly as plain text.

2. 2+01:00

   The UTC offset

   Says which time zone the clock was in (here Central European Time). Without it, 09:14 is ambiguous, especially across servers or a daylight-saving change.

3. 3INFO / DEBUG / WARN / ERROR

   The level

   How serious the event is. Padded to one width so the columns line up. Production systems often hide DEBUG lines.

4. 4[http-1]

   The thread

   Which part of the program wrote the line. Requests handled at the same time interleave in the file, so this helps pull them apart.

5. 5app.Payment

   The logger name

   The component that wrote the line, usually named after the module or class.

6. 6request_id=7f3a22

   A correlation ID

   The same ID on every line about one request, so grep 7f3a22 collects its whole story, here a failed payment, a retry and a success.

7. 7order=A-1001 amount=34.00 EUR

   Key=value fields

   Half-structured data inside the message, easy to search and extract. JSON Lines logs take this all the way, with every line a JSON object.

8. 8user="eve\nINFO [main] …"

   An escaped line break

   Someone typed a line break and a fake log entry as their user name. The program wrote it as the two characters \n, so it stays on one line instead of forging a second entry. That's log injection, defused.

9. 9java.net.SocketTimeoutException … / at …

   A multi-line entry

   A stack trace spreads one event over several lines that don't start with a timestamp. Tools that treat every line as an event miscount these.

Formats

Common log layouts: syslog, Combined Log Format, JSON Lines

203.0.113.7 - - [27/Oct/2026:09:14:10 +0100] "GET /old-page HTTP/1.1" 301 162 "-" "ExampleBot/2.1 (+https://bot.example.org/about)"
│           │ │ │                            │                        │   │   │   └ User-Agent header, as sent by the client
│           │ │ │                            │                        │   │   └ Referer header ("-" = none)
│           │ │ │                            │                        │   └ bytes in the response body
│           │ │ │                            │                        └ HTTP status code
│           │ │ │                            └ the request line: method, path, protocol
│           │ │ └ local time, with the server's UTC offset
│           │ └ user name from HTTP authentication ("-" = none)
│           └ identd user, practically always "-"
└ client IP address (or the last proxy's)

<134>1 2026-10-27T09:14:12.301+01:00 web01.example.com checkout 4123 CART [exampleSDID@32473 cart="c-1093" qty="2"] item added
│    │ │                             │                 │        │    │    │                                         └ MSG, free text
│    │ │                             │                 │        │    │    └ STRUCTURED-DATA, or "-" if none
│    │ │                             │                 │        │    └ MSGID, a type of message
│    │ │                             │                 │        └ PROCID, often the process ID
│    │ │                             │                 └ APP-NAME
│    │ │                             └ HOSTNAME
│    │ └ TIMESTAMP, RFC 3339 with offset
│    └ VERSION, 1 in RFC 5424
└ PRI: facility 16 (local0) × 8 + severity 6 (informational)

Time

Timestamps and time zones

Severity

Log levels: from DEBUG to EMERGENCY

Keeping it small

Log rotation: .log.1, .log.2.gz and dated files

How to

How to open and read a log file, even a huge one

tail -n 100 app.log            # the last 100 lines
tail -f app.log                # keep printing new lines as they're written
less +F app.log                # follow in less; Ctrl+C to scroll, F to follow again
grep -i "error" app.log        # lines containing "error", any case
zgrep "A-1001" app.log.*.gz    # search rotated, compressed logs
awk '{print $9}' access.log | sort | uniq -c | sort -rn   # count status codes
jq -c 'select(.level == "error")' app.jsonl               # filter JSON Lines
journalctl -u nginx --since "1 hour ago"                  # systemd journal

# Windows PowerShell
Get-Content app.log -Tail 50 -Wait

Related formats

.log vs .txt, .jsonl, .evtx and the journal

Privacy

Privacy and security: what logs give away

Free downloads

Sample log files to download

Free sample log files for testing log viewers, parsers, shippers, upload limits and redaction tools. All data is fictional: IP addresses come only from the documentation ranges and host names from example.com, example.org and example.net. Each file was checked with a parser for its layout.

Loading…

What's inside sample-app.log

A log can't contain comments without becoming part of the log, so the test cases are in the lines themselves. Open the file in a text editor to see these parts.

1. Lines 1 to 6: startup

   Version, profile and time zone, then DEBUG lines, including a database URL with the password already masked as ****.

2. Lines 7 to 12: requests

   Each request has a request_id, a method, path, status and duration. A WARN flags a slow query that took 1,240 ms.

3. Line 13: an injection attempt

   A user name containing a line break and a fake INFO entry, logged with the line break escaped as \n, so it stays one line.

4. Lines 14 to 21: a multi-line error and a retry

   An ERROR followed by a Java stack trace (the exception and three at lines), then a retry and success, all sharing request_id=7f3a22.

5. Lines 22 to 24: a job, UTF-8 and a server error

   A scheduled cleanup job, a search for café logged both URL-encoded and as UTF-8 text, then a 500 error.

6. Lines 25 to 27: shutdown

   A SIGTERM, the connection pool closing, and a summary: 9 requests, 1 failed. Every timestamp has the +01:00 offset.

All sample LOG files

• Application log

  sample-app.log · 2.8 KB (2,884 bytes)

  27 lines from a fictional checkout service: ISO 8601 timestamps with offset, four levels, threads, logger names, request IDs, key=value fields, a masked password, an escaped injection attempt and a multi-line stack trace.

  • Testing log viewers, highlighters and multi-line parsing
  • Teaching what a log line contains
  DownloadOpen

• Nginx access log (Combined Log Format)

  sample-nginx-access.log · 3.7 KB (3,805 bytes)

  21 requests in the default combined format: IPv4 and IPv6 clients from the documentation ranges, statuses 200, 201, 206, 301, 304, 401, 404 and 500, a crawler, scanner probes for /wp-login.php and /.env, an authenticated user, and a User-Agent with quotes and a line break escaped by Nginx as \x22 and \x0A.

  • Testing access-log parsers and analytics tools such as GoAccess
  • Practising `awk`, `grep` and `sort` on web logs
  DownloadOpen

• JSON Lines log

  sample-json-lines.log · 2.5 KB (2,520 bytes)

  15 structured events, one compact JSON object per line, with UTC timestamps, nested objects, an array, a boolean, a stack trace and an injection attempt stored safely as \n inside strings, and non-ASCII text (café crème, 日本語).

  • Testing `jq`, log shippers and JSON Lines parsers
  • Comparing structured and plain-text logging
  DownloadOpen

• Syslog messages (RFC 5424)

  sample-syslog-rfc5424.log · 1.7 KB (1,743 bytes)

  14 messages with priorities from 0 to 135, hosts given as names and as an IP address, - for empty fields, the reserved timeQuality, origin and meta elements, private @32473 structured data with escaped \", \] and \\, and two messages whose UTF-8 text starts with a byte order mark, as RFC 5424 specifies.

  • Testing syslog parsers and collectors
  • Checking structured-data escaping and BOM handling
  DownloadOpen

• IIS-style W3C extended log (CRLF)

  sample-iis-w3c.log · 2.0 KB (2,070 bytes)

  Windows line endings, #Software, #Version, #Date, #Remark and #Fields directives, then 10 requests with 15 space-separated fields in UTC, spaces in User-Agent strings written as +, and a domain user name.

  • Testing W3C log parsers and CRLF handling
  • Field-mapping tests driven by a `#Fields` header
  DownloadOpen

• 1 MB application log

  sample-1mb.log · 1 MB (1,048,576 bytes)

  10,188 application log lines over a fictional day, in the same layout as sample-app.log, with LF line endings and exactly 1,048,576 bytes (1 MiB).

  • Upload limits and timeouts
  • Log viewer, `grep` and parser performance
  DownloadOpen

Ways to test with them

• Parsers: run each layout through your parser. Every line of sample-nginx-access.log should yield 9 fields, every line of sample-json-lines.log one JSON object, and sample-app.log 23 entries, because 4 of its 27 lines belong to a stack trace.
• Escaping: the injection attempts in the app and JSON logs, and the escaped User-Agent in the Nginx log, should each stay one entry. A viewer that shows a separate "admin signed in" event has unescaped them.
• Encodings and line endings: sample-iis-w3c.log uses CRLF, sample-syslog-rfc5424.log has byte order marks in the middle of two lines, and the app and JSON logs contain UTF-8 text. None should produce Ã or �.
• Redaction: point a redaction tool at the samples; it should find the documentation IP addresses, the masked email a***@example.com and the password=**** field.
• Upload limits: sample-1mb.log is exactly 1,048,576 bytes, for testing a limit at the boundary.

Free to use for testing, teaching and demos, commercially or not, with no attribution needed. A link back to this page is always appreciated.

Questions

LOG files, frequently asked