/var/log files, real‐time monitoring with tail, and querying the systemd Journal with journalctl.
Overview of Linux Logging
Linux servers record almost every event—kernel messages, application errors, authentication attempts, service activity—in plain‐text logs. A logging daemon (typically rsyslog) collects these messages and writes them to files under/var/log. You can then search, filter, and monitor these logs.
Listing Log Files in /var/log
To see available log files:Common Log Files
Inspecting Logs as Root
Most files in/var/log are only readable by root:
Use
sudo or su to become root before inspecting logs:Finding SSH Logs
To locate where SSH events are recorded, search all files for “ssh”:/var/log/secure. View it with:
- Date and time
- Hostname
- Process name and ID
- Descriptive message
Live Monitoring with tail
Watch new log entries in real time with:Ctrl+C to exit follow mode.
Querying the systemd Journal with journalctl
Modern Linux distros use the systemd Journal.journalctl provides powerful querying options.
Filter by Command
Filter by Service Unit
Jump to End or Follow
By default, systemd Journal logs are stored in memory and cleared on reboot.
To enable persistent storage:
To enable persistent storage:
Filtering Journal Entries
By Priority
Show errors and above:By Content
Use grep‐style patterns:By Time
Login History with last and lastlog
- last: Shows recent logins, reboots, and shutdowns.
- lastlog: Lists the most recent login for each user.