Skip to main content
In this guide, you will learn how to locate and analyze system log files on a Linux system. Logging is a critical part of managing any Linux server since logs offer detailed insights into system activities—covering events such as user actions, system errors, and service operations. These logs are written as text messages, making them easy to search, read, and troubleshoot.

​
Logging Basics

The Linux kernel and many applications generate status messages, errors, and warnings, which are stored in log files. Because multiple programs continuously generate these messages, logging daemons are used to collect and organize information into centralized log files. The most common logging daemon on Linux is rsyslog (Rocket Fast System for Log Processing). By default, rsyslog stores log files in the /var/log directory. These plain text files can be easily explored using text-search tools like grep. Below is an example of listing the files in the /var/log directory:
Most log files under /var/log are restricted to the root user. If you need to view these logs as a non-root user, consider switching to root using commands like su --login or sudo --login.
For example:
or

​
Identifying Specific Log Files

If you are unsure where specific logs are stored—such as SSH logs that give details about login attempts—you can search all log files for entries related to the SSH daemon (sshd):
The output might look like this:
This indicates that SSH logs are primarily found in /var/log/auth.log. You can open this file using an editor like Vim or a pager such as less to search for additional SSH-specific details. Example output from /var/log/auth.log:
Another key log file is /var/log/syslog, which includes general system messages:
Older log files often have suffixes such as .1 or are compressed with .gz, while the uncompressed file (for example, auth.log) contains the latest entries.

​
Monitoring Logs in Real Time

When you need to debug an application or monitor system changes as they happen, you can use the tail command with the -f option to follow a log file in real time. For example:
Press Ctrl+C to exit the follow mode. To filter the live output for specific entries, such as those related to sudo, you can pipe the output through grep:

​
Advanced Log Analysis Using journalctl

Modern Linux systems that use systemd employ the journal daemon for structured log management. The journalctl command provides powerful options to filter and analyze logs.

​
Viewing Logs by Command

To view logs for a specific command, such as sudo, first determine its full path:
Then filter the journal logs associated with it:
This command opens the log output in your default pager (typically less), allowing you to navigate and search through the logs. Press q to exit the pager.

​
Viewing All Journal Logs

To view all entries collected by the journal daemon, run:
Jump to the end of the log output by pressing > within the pager, or run:

​
Following Journal Logs Live

Just like tail -f, you can follow journal logs in real time by using:
Press Ctrl+C to exit follow mode.

​
Filtering Logs by Priority

Use the -p option with journalctl to filter log output based on priority levels. Available priorities include: emerg, alert, crit, err, warning, notice, info, and debug. For example, to display only error messages:
If you forget the priority names, type journalctl -p (with a trailing space) and press Tab twice to list all available options.

​
Combining Filters with Regex

You can combine filters with regular expressions. For example, to display only log entries with info priority where messages start with the letter “b”, use:

​
Filtering Logs by Time Range

To filter journal logs by time, use the -S (since) and -U (until) options. For instance, to view logs between 1 a.m. and 2 a.m.:
For full date and time filtering, enclose the datetime string in single quotes:

​
Viewing Logs by Boot Session

The journal organizes log entries by boot session. To view logs from the current boot, run:
For previous boot sessions, use a negative offset (e.g., -b -2 for two boots ago). Note that some systems might only store logs in memory, so persistent logging may not be available unless enabled. To enable persistent logging, create the directory:
If you run a journalctl command and see no output, try using sudo or check that your user has the appropriate permissions.

​
Viewing User Login History

Reviewing user login history is straightforward with the last command, which displays recent logins in reverse chronological order:
The lastlog command provides a summary of the last login times for each user and can include the originating IP address for remote logins (such as SSH):

​
Summary

In this article, we explored how to locate and analyze system log files in Linux. We examined where logs are stored (mostly under /var/log), how to view and filter logs using tools like grep, tail, and journalctl, and how to review user login history with commands such as last and lastlog. By mastering these tools, you can efficiently diagnose issues, monitor system activities, and ensure that your Linux server is running smoothly. Happy logging!

Watch Video

Practice Lab