# Files, text & logs

Reading logs: journalctl and /var/log

Find out what a service is doing right now and what happened before it crashed.

journalctl: logs for systemd services

On systemd distros (Ubuntu, Debian, RHEL/Fedora, openSUSE, Arch), journalctl is the central place service logs go. -u filters to one service, -f follows live like tail -f, -b shows only logs since the last boot.

bash

journalctl -u nginx -f
journalctl -u nginx --since '1 hour ago'
journalctl -b -p err

Traditional log files under /var/log

Not everything goes through the journal — many apps and Debian/Ubuntu's syslog still write plain text files here. Common ones: /var/log/syslog (or /var/log/messages on RHEL-based distros), /var/log/auth.log (login/sudo attempts), and per-app directories like /var/log/nginx/.

bash

tail -f /var/log/syslog
less /var/log/auth.log

Following multiple files at once

tail -f accepts several files and prefixes each line with its filename, useful when a problem could be in either the app log or the web server's error log.

bash

tail -f /var/log/nginx/error.log /var/log/nginx/access.log

Log rotation

logrotate (already configured by most package-installed services) compresses and deletes old logs on a schedule so /var/log doesn't fill the disk. Check its config under /etc/logrotate.d/ before assuming a growing log file will be handled automatically.

bash

cat /etc/logrotate.d/nginx