Logs are often the fastest way to understand what a service is doing. On systemd-based systems, journalctl is usually the first tool to check.

Useful commands

• journalctl -xe to inspect recent important messages.
• journalctl -u nginx to look at one service.
• journalctl --since today to narrow the time range.

What to look for

Focus on repeated warnings, failed startup messages, and timestamps that match the moment the problem happened.