Skip to main content
In this guide, you will learn how to locate and analyze system log files on a Linux system. Logs are critical for understanding system events—such as user activity, errors, and system warnings—in server environments. Linux logs are stored as plain text files that record messages generated by the Linux kernel and various applications. The most common logging daemon, rsyslog (Rocket Fast System for Log Processing), organizes these messages in the /var/log directory. Below is a simple command to list the files in the /var/log directory. Since these files are plain text, you can use utilities like grep or less to search through them. Note that many of these files require root privileges to access.
For example, listing the contents of /var/log might display entries similar to this:
If you need to work with restricted log files, you may have to log in as the root user. You can do this either by using the su command (and providing the root password) or with sudo --login:
Keep in mind that switching to the root user helps you access all log files, but also demands careful handling to avoid unintended modifications.

​
Analyzing Specific Log Files

Suppose you need to determine where SSH login events are recorded. SSH-related entries are typically found in the /var/log/secure file. You can search the entire /var/log directory for the keyword “ssh” as follows:
Since SSH logs are stored in /var/log/secure, you can view this file using a pager like less:
Inside the secure log, you will see details such as successful SSH logins, failed authentication attempts, use of sudo privileges, and password change events. A typical output might look like this:
System events such as boot messages are generally stored in /var/log/messages. Additionally, you may come across rotated logs that include date information (for example, boot.log-20211026), which are archives of older log entries. Below is an example showing how to view both secure and messages logs:
The rotated log file, such as boot.log-20211026, indicates that the logs in the current /var/log/boot.log were archived on October 26, 2021, preserving past log history.

​
Following Live Log Outputs

When troubleshooting an application or monitoring system activity, you might want to view log entries as they are recorded. The tail command with the -F flag enables follow mode, which displays new log entries in real time. To exit follow mode, simply press Control+C.

​
Using journalctl for Enhanced Log Analysis

Modern Linux systems use the systemd journal to manage structured logs. The journalctl command offers numerous powerful options for filtering and displaying logs.

​
Viewing Logs for a Specific Command

First, determine the full path of a command (e.g., sudo):
Then, view only the logs generated by that command:
For viewing SSH daemon logs, run:
Running journalctl without options displays all logs. During active troubleshooting, jump to the end of the log by using the -e flag:
Similar to tail, journalctl supports follow mode for live log monitoring. Activate this mode with the -f flag and use Control+C to exit:

​
Filtering Logs by Priority

Logs are tagged with priorities such as debug, info, notice, warning, error, crit, alert, and emerg. To view only the error-level messages, use the -p option like this:
To see all available priority codes, simply type:
Additionally, you can filter logs similarly to grep using the -g flag. For example, to show info-level log messages beginning with the letter “B”, use:

​
Filtering by Time

You can restrict your log output to a specific time window using the -S (since) and -U (until) options. For example, to view logs recorded between 1 a.m. and 2 a.m.:
Or, to display logs recorded after a particular date and time (e.g., November 16, 2021, at 12:04:55):

​
Viewing Logs from a Specific Boot

Often, you may want to see only the logs from the current boot session. Use the -b option with a boot offset, where 0 refers to the current boot:
To view logs from the previous boot, simply use -b -1. Note that on systems like CentOS the journal may be stored in memory by default, so persistent storage must be configured if you require logs from previous boots:
Before configuring persistent journals, ensure you understand the disk space implications and security policies of your environment.

​
Viewing Login History

To review user login history, you can use the last command. This command displays recent session information, with the newest entries at the top, including system reboots. For example:
Alternatively, the lastlog command displays the most recent login for each user, including remote SSH login details:

​
Conclusion

This guide has explored multiple methods to locate and analyze system log files on Linux. Whether browsing the plain text files in /var/log using commands like grep and less or leveraging the powerful filtering and live monitoring features of journalctl, understanding your system logs is essential for effective troubleshooting and maintaining security. Let’s now proceed to some hands-on labs.

Watch Video

Practice Lab