Exercise: diagnosing from logs

Context

You are given a VM where httpd will not start. No internet. Find out why.

Tasks

1. Check the service state and read the last 30 journal lines for it.
2. Look for a recent SELinux denial.
3. Check whether port 80 is already taken.
4. Fix it and prove the service is running.

Verify

systemctl is-active httpd        # active
ss -ltnp | grep :80
ausearch -m AVC -ts recent | tail -5

Method

systemctl status httpd --no-pager
journalctl -u httpd -n 30 --no-pager
ausearch -m AVC -ts recent 2>/dev/null | tail -20
ss -ltnp | grep :80

• "address already in use" → another process is listening: fuser -n tcp 80 or ss -ltnp.
• "Permission denied" on a file → SELinux: ls -Z, semanage fcontext, restorecon.
• "Failed to start … status=203/EXEC" → wrong path or non-executable script in ExecStart.