How to View Linux Logs from Command Line?

What Are Linux Log Files

Linux logs are records that capture important information about system activities, events, errors, and processes within a Linux operating system. These are the digital breadcrumbs left behind by the operating system, applications, and services, chronicling their activities and encounters. Whether it's the system startup process, network connections, hardware events, or application crashes, Linux logs capture a comprehensive record of these occurrences, enabling us to investigate, diagnose, and resolve issues efficiently.

Where to Find Linux Logs?

In Linux log files are stored in the /var/log directory, which serves as the central location for various logs generated by the system and applications. This directory is typically accessible to administrators and contains valuable information for system monitoring, troubleshooting, and auditing.

To see the log files housed within this directory you can use the following commands:

• cd command to change the directory.

• ls command to see the log files housed within this directory.

How to View Linux Logs?

To access the contents of Linux log files, there are several methods available depending on your preference and requirements. Here are some common ways to access and view the contents of Linux log files

Using Cat Command

The cat command is a basic command line utility that can display the contents of a log file directly in the terminal. For example, to view the contents of the syslog file, the following command can be used:

The cat command is generally used to concatenate and display the contents of one or more files. While it can be used to view log files, it lacks advanced features such as scrolling or searching, making it less advantageous for large log files.

Using less Command/

The less command is a pager that allows us to scroll through log files, search for specific terms, and navigate large files. For example, to view the syslog file using less, the following command can be used:

Inside less, you can use the arrow keys to scroll up and down and press / to search for specific terms.

The less command allows interactive browsing, supports scrolling, and provides searching capabilities within the file. It is particularly useful for analyzing large log files and navigating through the content efficiently.

Using tail Command

The tail command can be used to display the last few lines of a log file. By default, it shows the last 10 lines, but you can specify a different number of lines using the -n option. For example, to view the last 5 lines of the syslog file, the following command can be used:

The tail command comes in handy when we only need to view the last few lines of a log file, making it suitable for real-time monitoring or quickly checking recent events. It can continuously display new lines appended to the file, which is beneficial for tracking ongoing activities or troubleshooting. To learn more about the tail command you can check out tail command in linux.

Using head Command

The head command is the opposite of tail and can be used to display the first few lines of a log file. Similar to the tail command by default it displays the first 10 lines of a text file, but we can specify the number of lines to display using the -n option. For example, to view the first 5 lines of the syslog file, the following command can be used:

The head command can be useful when we need to get a glimpse of the initial entries of a log file. To learn more about the head command you can check out head command in Linux

Using grep Command

The grep command is useful for filtering log files based on specific patterns or keywords. For example, to search for occurrences of the word "error" in the syslog file, the following command can be used:

Since we can filter out relevant lines using the grep command it is highly beneficial for target analysis or troubleshooting.

Using dmesg Command

The dmesg command when run on its own will display kernel ring buffer messages, which can include critical system information. By default, the dmesg command requires sudo permissions to run.

To get a much more readable output, we can pipe it through commands like less or grep. The output of dmesg piped into grep is as follows:

It is advantageous for reviewing hardware-related events, low-level errors, and kernel-level messages. It helps diagnose hardware issues and track system-level events.

Most Important Linux Logs

There are many log files that are housed within the /var/log directory, Let us learn about some of the most essential Linux log files:

• syslog: The syslog file (/var/log/syslog or /var/log/messages) contains general system messages, including kernel messages, system daemons, and applications. It provides an overview of system events and can be useful for troubleshooting various issues.

• auth.log: The auth.log file (/var/log/auth.log or /var/log/secure) records authentication-related events, such as user logins, authentication failures, and system authentication configuration changes. It helps in tracking security-related activities.

• kern.log: The kern.log file (/var/log/kern.log) captures kernel-related messages and events, including hardware and driver-related information. It is crucial for diagnosing hardware issues, driver problems, and kernel-level errors.

• dpkg.log: The dpkg.log file (/var/log/dpkg.log) keeps a log of package management activities performed using the package manager (e.g., apt or dpkg). It records package installations, upgrades, and removals, providing a history of system package changes.

• syslog-ng: Syslog-ng is an enhanced system logging daemon that offers more advanced logging capabilities. It allows centralized logging, filtering, and forwarding of log messages. The configuration file for syslog-ng is typically located at /etc/syslog-ng/syslog-ng.conf.

• boot.log: The boot.log file (/var/log/boot.log) contains messages generated during the system boot process. It records information about system startup, hardware initialization, and services that started or failed to start during boot.

• cron The cron log file (/var/log/cron) contains information about scheduled tasks and cron job executions. It helps in monitoring and troubleshooting cron jobs and automated tasks.

• apache2: The Apache HTTP Server log files (/var/log/apache2/access.log and /var/log/apache2/error.log) provide detailed information about web server activity, client requests, and server errors. These logs are essential for diagnosing web server issues and monitoring web traffic.

GUIs for Viewing Linux Log Files

GUI tools provide a more user-friendly and visually appealing way to analyze and navigate through log data. Here are some popular GUIs for viewing Linux log files:

• Log File Viewer (gnome-system-log): This GUI tool is the default log viewer for GNOME-based Linux distributions. It provides a simple and intuitive interface for browsing and analyzing various system log files. It allows you to filter log entries based on severity, time range, and log sources. You can also search for specific keywords within the logs.

• KSystemLog: KSystemLog is a beginner-friendly log viewer specifically designed for KDE-based Linux distributions. It offers a user-friendly interface for viewing and analyzing system logs. It supports different log formats and provides filtering options to narrow down log entries. KSystemLog also includes features like bookmarking important log entries and highlighting specific log levels.

• Glogg: Glogg is a powerful log file viewer that is available for multiple platforms, including Linux. It is designed to handle large log files efficiently and provides real-time updates as new log entries are added. Glogg supports advanced search functionalities, such as regular expressions, making it suitable for detailed log analysis. It also allows you to save search results and highlight specific patterns.

• Xlogmaster: Xlogmaster is another GUI log file viewer that provides a straightforward interface for browsing and monitoring log files. It supports filtering log entries based on different criteria and offers features like search functionality, bookmarking, and log highlighting.

Learn More

To learn more about the Linux Filesystem and commands, you can check out the following articles

• How to Check Memory Usage in Linux
• Basic Linux Commands with Examples
• Process Management in Linux
• Linux File System and Directory Structure