Linux System Administration for Beginners

Operation of Running Systems

Locate and analyze system log files

Learn how to find, inspect, and monitor Linux system logs to troubleshoot issues, audit user activity, and understand system behavior. This guide covers classic /var/log files, real‐time monitoring with tail, and querying the systemd Journal with journalctl.

Overview of Linux Logging

Linux servers record almost every event—kernel messages, application errors, authentication attempts, service activity—in plain‐text logs. A logging daemon (typically rsyslog) collects these messages and writes them to files under /var/log. You can then search, filter, and monitor these logs.

Listing Log Files in /var/log

To see available log files:

ls /var/log/

Example output:

anaconda           dnf.rpm.log       secure
audit              firewalld         secure-20211026
boot.log           gdm               spooler
...                ...               ...

Common Log Files

FileDescription
/var/log/secureSSH authentication, sudo and PAM messages
/var/log/messagesGeneral system messages and kernel events
/var/log/boot.logBoot sequence messages
/var/log/auditAudit framework records
/var/log/dnf.rpm.logPackage installation and update history

Inspecting Logs as Root

Most files in /var/log are only readable by root:

Note

Use sudo or su to become root before inspecting logs:

sudo --login
# or
su -

Finding SSH Logs

To locate where SSH events are recorded, search all files for “ssh”:

grep -R "ssh" /var/log/

You’ll find entries in /var/log/secure. View it with:

less /var/log/secure

Log format typically includes:

  • Date and time
  • Hostname
  • Process name and ID
  • Descriptive message

Live Monitoring with tail

Watch new log entries in real time with:

tail -F /var/log/secure

Press Ctrl+C to exit follow mode.

Querying the systemd Journal with journalctl

Modern Linux distros use the systemd Journal. journalctl provides powerful querying options.

Filter by Command

which sudo
journalctl /bin/sudo

Filter by Service Unit

journalctl -u sshd.service

Jump to End or Follow

CommandDescription
journalctlShow all journal entries
journalctl -eJump to end of logs
journalctl -fFollow new entries (like tail)

Warning

By default, systemd Journal logs are stored in memory and cleared on reboot.
To enable persistent storage:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Filtering Journal Entries

By Priority

Show errors and above:

journalctl -p err

By Content

Use grep‐style patterns:

journalctl -p info -g '^B'

By Time

FilterExample
Since a specific timejournalctl -S 02:00
Between two timestampsjournalctl -S '2021-11-16 01:00' -U '2021-11-16 02:00'
Current or previous boot logsjournalctl -b 0 / journalctl -b -1

Login History with last and lastlog

  • last: Shows recent logins, reboots, and shutdowns.
last
  • lastlog: Lists the most recent login for each user.
lastlog
CommandPurpose
lastDisplay recent logins and reboots
lastlogShow last login per user

Learn More

Watch Video

Watch video content

Practice Lab

Practice lab

Previous
Diagnose and manage processes