How to Check System Logs in Linux [ 4 Easy Methods]

Written by

Ojash

Reviewed by

Akshat

Last updated: June 15, 2024

Expert verified

System logs can feel overwhelming, but they’re crucial for keeping your Linux system running smoothly. If you’ve dealt with system crashes or strange errors, there’s a solution. In this post, I’ll show you how to check system logs in Linux and configure them. You’ll discover where to find logs, how to read them, and the best practices for managing them effectively. By the end, you’ll have the skills to monitor your system’s health, troubleshoot problems, and ensure security more efficiently. Let’s explore and make those logs work for you.

What are System Logs in Linux?

Linux system logs are files that record various events that happen on your Linux system. These events include system operations, errors, warnings, and other important messages that help you understand what’s going on with your system. System logs are essential for:

• Monitoring System Health: They help you keep track of your system’s performance and detect issues early.
• Troubleshooting Problems: When something goes wrong, system logs provide detailed information that can help you identify and fix the problem.
• Ensuring Security: Logs can alert you to unauthorized access attempts and other security-related events.

Where Are System Logs Located?

On most Linux systems, you can find system logs in the /var/log directory. This directory contains various log files, each serving a different purpose. Here are some common log files you might encounter:

1. /var/log/syslog or /var/log/messages: These files contain general system activity logs. They record information about the system’s operation, including startup messages, shutdown messages, and other system events.
2. /var/log/auth.log or /var/log/secure: These files keep logs of authentication-related events, such as login attempts and security notices.
3. /var/log/kern.log: This file contains kernel logs. The kernel is the core part of the operating system, and this log file records low-level system operations and hardware-related events.
4. /var/log/dmesg: This file records boot and kernel messages. It provides information about the hardware detected during system startup and any errors that occurred.
5. /var/log/boot.log: This file contains messages related to the boot process. It helps you understand what happens during system startup.

System logs are typically managed by a logging daemon, such as syslog or systemd-journald. These daemons collect log messages from various sources and write them to the appropriate log files based on predefined rules.

To view and analyze system logs, you can use various command-line tools, such as:

• cat: Display the contents of a log file.
• tail: Display the last few lines of a log file in real-time.
• grep: Search for specific patterns or keywords within log files.
• less: Interactively view and navigate through large log files.

In addition to command-line tools, there are also graphical log viewers and centralized log management solutions available for Linux, which can help in analyzing and visualizing log data more effectively.

How to Check System Logs in Linux?

That was the quick answer. Below, we’ll dive into more details on this method along with 3 more methods to Linux check system logs, each suited to different requirements and user preferences:

1. Directly Viewing Logs via Command Line

Accessing log files directly through the command line is a quick and effective way to check system logs for immediate troubleshooting needs. Follow these steps to check Linux logs:

1. Access your Terminal window.

2. Type the following command to enter the directory where log files are stored: 

cd /var/log/

This command changes your current directory to /var/log/, where most log files are stored.

3. Now enter the following command to view all files in the log directory:

ls -lah 

It will also include details about their size and modification date.

4. Use the less command for an interactive view. For example, type: 

less syslog

This command opens the syslog file, allowing you to scroll through it interactively.

5. Navigate within the file using the arrow keys. Press q to quit and return to the command prompt.

2. journalctl for systemd Logs

journalctl is a tool specifically designed for viewing Linux logs managed by systemd, the default init system for many Linux distributions. This method offers powerful filtering options that are crucial for managing modern Linux systems. Here is the step-by-step guide to check system logs in Linux:

1. Open the Terminal.
2. View all system logs by running the command:

journalctl

Simply display all logs from the systemd journal.

3. To narrow down Linux logs to a specific timeframe, type:

journalctl --since yesterday

This filters logs to show entries from yesterday to now.

4. To see logs of a particular severity, enter:

journalctl --priority=err

This shows logs with error severity.

3. Graphical Log Viewing Tools

Graphical tools such as GNOME Logs provide a user-friendly interface to view system logs, ideal for users who prefer graphical applications over command line tools. Follow these steps to check system logs in Linux:

1. Open your Terminal and install GNOME logs:

sudo apt install gnome-logs

Enter your password to proceed with the installation.

2. Find and launch GNOME Logs from your application menu or type gnome-logs in the Terminal.

3. The interface will display linux logs organized by different criteria. Use the search box and filters to locate specific log entries.

4. dmesg for Kernel Logs

The dmesg command is essential for viewing kernel messages, useful for diagnosing hardware and driver issues. It shows messages from the Linux kernel that are stored in the ring buffer. Here is how to Linux show logs:

1. Launch the command prompt.
2. Run the following command and press Enter:

dmesg

It will show all kernel messages.

3. Use the following command to view messages with human-readable timestamps:

dmesg -T

This enhances the readability of timestamps.

4. Filter messages by level with the command: 

dmesg --level=err

This command filters the output to show only error messages.

How to Configure System Logs on Linux

System logs are essential for monitoring, troubleshooting, and securing Linux systems. This guide will provide clear and concise steps to configure system logs on Linux, covering the default logging system and basic customization.

1. Open your Terminal and run the following command to install and start rsyslog:

sudo apt-get install rsyslog      

2. Enable rsyslog to start on boot and start the service now:

sudo systemctl enable rsyslog

sudo systemctl start rsyslog

3. Open the rsyslog configuration file:

sudo nano /etc/rsyslog.conf

4. Set global directives in the configuration file:

$FileOwner root

$FileGroup adm

$FileCreateMode 0640

$IncludeConfig /etc/rsyslog.d/*.conf

5. Define log rules (e.g., log all authentication messages):

auth.* /var/log/auth.log

6. Save and close the file.

7. Now view the logs by running the command:

cat /var/log/syslog

8. Open the logrotate configuration file:

sudo nano /etc/logrotate.conf

9. Add a log rotation rule (e.g., rotate /var/log/syslog weekly):

/var/log/syslog {

  weekly

  rotate 4

  compress

  delaycompress

  missingok

  notifempty

  create 0640 root adm

}

10. Save and close the file.

11. Force log rotation manually (optional):

sudo logrotate -f /etc/logrotate.conf

12. Set appropriate permissions on the log file:

sudo chmod 640 /var/log/syslog

sudo chown root:adm /var/log/syslog

8 Best Practices for Effective Log Management

Proper log management is crucial for maintaining system integrity and security. Proper log management is crucial for maintaining system integrity and security. Here are eight best practices to follow for effective log management:

• 📊 Centralize Log Management: Combine all your logs in one place to make it easier to check and analyze them. This helps you see the big picture and spot issues across your entire system more quickly.
• 🔒 Secure Log Data: Keep your log data safe by using strong access controls and encryption. Make sure that only authorized personnel can access sensitive log information, whether it’s stored or being sent somewhere else.
• 🔄 Implement Log Rotation: Use log rotation to manage the size of log files and save disk space. Automatically replace old logs with new ones and archive the old data to keep your system running smoothly.
• 🛠️ Automate Monitoring and Alerts: Set up systems to automatically watch over your logs and alert you to unusual or suspicious activities. This helps you respond quickly to potential problems before they escalate.
• 🔎 Perform Regular Audits: Regularly check your log management practices and systems to make sure they comply with your company’s policies and any legal requirements. Audits help fix any weaknesses before they become serious issues.
• 📅 Maintain a Consistent Log Format: Keep log formats the same across all systems and devices to simplify analysis and automate reports. Using one format helps avoid confusion and makes processing data easier and faster.
• 🌐 Utilize Log Analysis Tools: Use powerful tools to dig deep into your logs and pull out useful information. These tools can help you see trends, predict problems before they happen, and get helpful insights.
• 🔄 Ensure High Availability of Log Data: Make sure your log data is always available by setting up backups and systems that can withstand failures. This protects your logs from being lost in case something goes wrong with your system.

Linux View System Logs: Final Thoughts

In this guide, I have explored how to check system log in Linux, including various tools and techniques. I have also covered configuring system logs and highlighted best practices for effective log management, such as log rotation and securing log files.

If you found this useful, I recommend exploring:

• Techniques for emptying log files to manage disk space efficiently.
• Methods to check Crontab logs for ensuring your scheduled tasks run as expected.
• Using the Journalctl command to tail service logs, enhancing your real-time monitoring capabilities.

Frequently Asked Questions