Linux how to view system logs

The main methods to view system logs in Linux are: 1. Use the journalctl command (applicable to systems using systemd), such as journalctl -f to monitor the logs in real time, journalctl -u ssh.service to view specific service logs, journalctl -p err filter logs above the error level; 2. View traditional log files in the /var/log directory, such as /var/log/syslog or /var/log/messages to record system events, /var/log/auth.log record login attempts, and use less, tail -f and other commands to view; 3. Use the dmesg command to view kernel ring buffer information, dmesg -H --follow can display time-stamped hardware and startup messages in real time; 4. Pay attention to log permissions and rotation issues. Compressed logs can be viewed by zless or zcat. Finally, journalctl or traditional log files should be selected according to the system type for troubleshooting to fully cover various log needs.

In Linux, system logs provide valuable information about system events, errors, services, and security-related activities. There are several ways to view system logs depending on your distribution and logging system (typically syslog or journald ). Here's how to check them effectively.

1. Using journalctl (for systems with systemd )

Most modern Linux distributions use systemd , which logs events through journald . The journalctl command is the primary tool to access these logs.

• View all logs :

   journalctl

• View recent logs :

   journalctl -n 50

  (Shows the last 50 lines)

• Follow logs in real time :

   journalctl -f

  (Like tail -f , useful for monitoring)

• View logs from today only :

   journalctl --since today

• Check logs for a specific service :

   journalctl -u ssh.service

  (Replace ssh.service with any service name)

• View kernel messages :

   journalctl -k

• Filter by log level (eg, errors and above):

   journalctl -p err

  (Levels: debug, info, notice, warning, err, crit, alert, emergeg)

Note: Use sudo if you need to access system-wide logs and aren't in the systemd-journal group.

2. View traditional log files in /var/log

Even with systemd , logs are often also stored in plain text files under /var/log .

Common log files include:

• /var/log/syslog – General system log (on Debian/Ubuntu)
• /var/log/messages – General system log (on RHEL/CentOS/Fedora)
• /var/log/auth.log – Authentication and login attempts (Debian/Ubuntu)
• /var/log/secure – Security and authentication logs (RHEL/CentOS)
• /var/log/kern.log – Kernel-specific messages
• /var/log/boot.log – System boot messages
• /var/log/dmesg – Kernel ring buffer (hardware/driver messages)

You can view them with:

 less /var/log/syslog
tail -f /var/log/auth.log
cat /var/log/dmesg

3. Using dmesg for hardware and boot messages

The dmesg command shows kernel ring buffer messages, useful for hardware issues and early boot problems.

• View all kernel messages:

   dmesg

• Human-readable output with timestamps:

   dmesg -H

• Follow new messages:

   dmesg -H --follow

4. Log management tips

• Permissions : Some logs require sudo to read.
• Log rotation : Old logs may be compressed (eg, syslog.1.gz ) and rotated by logrotate .
• Use zcat or zless to view compressed logs:

   zless /var/log/syslog.1.gz

• On older systems without systemd , tools like rsyslog or syslog-ng handle logging, and logs are only in /var/log .

Basically, start with journalctl -f for real-time monitoring or check /var/log/syslog (or /var/log/messages ) for a quick look. The exact method depends on your system, but these tools cover most cases.

The above is the detailed content of Linux how to view system logs. For more information, please follow other related articles on the PHP Chinese website!