Linux System Logs

Where are system logs stored in Linux and how do you view them?

Linuxbeginner

// interview question

Where are system logs stored in Linux and how do you view them?

Sample answer

System logs in Linux are typically stored in /var/log. Key log files include: /var/log/syslog or /var/log/messages for general system logs, /var/log/auth.log for authentication events, /var/log/kern.log for kernel messages, and /var/log/dmesg for boot messages. Use commands like tail, cat, less, or journalctl (for systemd) to view logs.

Why this matters

Log analysis is a fundamental skill for troubleshooting issues in production systems. Understanding where logs are stored and how to efficiently search through them helps you quickly diagnose application crashes, security incidents, and system failures.

Code examples

Common log locations and viewing commands

bash

# View last 100 lines of syslog
tail -n 100 /var/log/syslog

# Follow logs in real-time
tail -f /var/log/syslog

# Search for errors in logs
grep -i 'error' /var/log/syslog

# View systemd journal logs
journalctl -u nginx --since '1 hour ago'

# View boot messages
dmesg | tail -50

Log rotation and management

bash

# Check log rotation config
cat /etc/logrotate.conf

# View compressed old logs
zcat /var/log/syslog.1.gz

# Search across multiple log files
grep -r 'connection refused' /var/log/