ag@linux:~$

history 19 of 36

Common Linux Log Files and What Each One Records

A list of common files in /var/log and what they contain, with the Red Hat vs Debian/Ubuntu differences and how to read logs with journalctl today.

Written

From my Linux study notes, 2015. Some commands and versions here are old, so please reuse them carefully. Anything marked "added later", and the notes at the end, explain what has changed since.

When something goes wrong on a Linux server, the logs are the first place to look. This is my list of common log files and what each is used for.

Before you start

  • Most files in /var/log can only be read by root, so run the commands as root or with sudo.
  • Not every file exists on every system. The names depend on the distribution and on which software is installed (see the notes after the list).

Common Linux log files: name and usage

  • /var/log/messages: general messages and system-related events. (The original said /var/log/message; the correct name is messages.) Used on Red Hat-family systems (CentOS, RHEL, Rocky Linux, AlmaLinux, Fedora).
  • /var/log/auth.log: authentication logs (logins, sudo, SSH). Used on Debian and Ubuntu.
  • /var/log/kern.log: kernel logs. Used on Debian and Ubuntu.
  • /var/log/cron.log: crond logs (cron jobs). On Red Hat-family systems the file is /var/log/cron. On Debian and Ubuntu, cron messages go to /var/log/syslog unless a separate cron.log has been enabled in the rsyslog configuration.
  • /var/log/maillog: mail server logs. This is the Red Hat-family name; Debian and Ubuntu use /var/log/mail.log.
  • /var/log/qmail/: qmail log directory (more files inside this directory). Only present if qmail is installed, and the location depends on how it was set up.
  • /var/log/httpd/: Apache access and error logs directory (Red Hat family). On Debian and Ubuntu it is /var/log/apache2/.
  • /var/log/lighttpd/: Lighttpd access and error logs directory.
  • /var/log/boot.log: system boot log.
  • /var/log/mysqld.log: MySQL database server log file. The location varies by version and package (MariaDB packages often use a different path); check the log_error setting in your MySQL/MariaDB configuration.
  • /var/log/secure: authentication log. This is the Red Hat-family equivalent of auth.log.
  • /var/log/utmp or /var/log/wtmp: login records files. Correction: wtmp is in /var/log/wtmp and holds login history, but utmp (who is logged in right now) is normally /var/run/utmp (/run/utmp on newer systems). These are binary files: read them with last (wtmp) and who (utmp), not cat. Failed logins are recorded in /var/log/btmp, read with sudo lastb.
  • /var/log/yum.log: yum log file (packages installed, updated and removed). On systems that use dnf, look at /var/log/dnf.log instead. On Debian and Ubuntu, package history is in /var/log/apt/history.log and /var/log/dpkg.log.

Red Hat family vs Debian/Ubuntu

What Red Hat family (CentOS, RHEL, Rocky, Alma) Debian / Ubuntu
General system log /var/log/messages /var/log/syslog
Authentication / SSH / sudo /var/log/secure /var/log/auth.log
Mail /var/log/maillog /var/log/mail.log
Cron /var/log/cron /var/log/syslog
Apache /var/log/httpd/ /var/log/apache2/

Reading log files

Show the last 50 lines of a log:

Terminal window
sudo tail -n 50 /var/log/messages

Follow a log live while you reproduce a problem (press Ctrl+C to stop):

Terminal window
sudo tail -f /var/log/secure

Search a log for a word, for example failed SSH logins:

Terminal window
sudo grep "Failed password" /var/log/secure

On Debian or Ubuntu, use /var/log/auth.log in place of /var/log/secure in the last two examples.

Notes for today

  • The systemd journal. Systems that use systemd (CentOS 7 and later, Rocky Linux, AlmaLinux, current Debian and Ubuntu) also record logs in the systemd journal, read with journalctl. The text files above are written by rsyslog; some newer installations do not install rsyslog by default, in which case the journal may be the only place to look. Useful commands:

    Terminal window
    sudo journalctl -u sshd
    sudo journalctl -f
    sudo journalctl -b
    sudo journalctl -p err

    These show logs for one service (on Debian/Ubuntu the SSH unit is ssh), follow new messages live, show messages since the last boot, and show only errors and worse.

  • Log rotation. Old logs are renamed and compressed by logrotate, so you may see files such as messages-20250101 or syslog.1 and syslog.2.gz. Use zless or zgrep to read the compressed ones.

  • Kernel messages can also be read with dmesg (may need sudo).