Locate and analyze system log files

Learn how to find, inspect, and monitor Linux system logs to troubleshoot issues, audit user activity, and understand system behavior. This guide covers classic /var/log files, real‐time monitoring with tail, and querying the systemd Journal with journalctl.

Overview of Linux Logging

Linux servers record almost every event—kernel messages, application errors, authentication attempts, service activity—in plain‐text logs. A logging daemon (typically rsyslog) collects these messages and writes them to files under /var/log. You can then search, filter, and monitor these logs.

Listing Log Files in /var/log

To see available log files:

ls /var/log/

Example output:

anaconda           dnf.rpm.log       secure
audit              firewalld         secure-20211026
boot.log           gdm               spooler
...                ...               ...

Common Log Files

Inspecting Logs as Root

Most files in /var/log are only readable by root:

sudo --login
# or
su -

Finding SSH Logs

To locate where SSH events are recorded, search all files for “ssh”:

grep -R "ssh" /var/log/

You’ll find entries in /var/log/secure. View it with:

less /var/log/secure

Log format typically includes:

• Date and time
• Hostname
• Process name and ID
• Descriptive message

Live Monitoring with tail

Watch new log entries in real time with:

tail -F /var/log/secure

Press Ctrl+C to exit follow mode.

Querying the systemd Journal with journalctl

Modern Linux distros use the systemd Journal. journalctl provides powerful querying options.

Filter by Command

which sudo
journalctl /bin/sudo

Filter by Service Unit

journalctl -u sshd.service

Jump to End or Follow

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Filtering Journal Entries

By Priority

Show errors and above:

journalctl -p err

By Content

Use grep‐style patterns:

journalctl -p info -g '^B'

By Time

Login History with last and lastlog

• last: Shows recent logins, reboots, and shutdowns.

last

• lastlog: Lists the most recent login for each user.

lastlog

Learn More

• systemd Journal documentation
• rsyslog official site
• Linux Logging Basics