Linux Log Files Location And How Do I View Logs Files on Linux?

I am a new Linux user. I would like to know where are the log files located under Debian/Ubuntu or CentOS/RHEL/Fedora Linux server? How do I open or view log files on Linux operating systems?

Almost all logfiles are located under /var/log directory and its sub-directories on Linux. You can change to this directory using the cd command. You need be the root user to view or access log files on Linux or Unix like operating systems. You can use the following commands to see the log files:
Tutorial details
Difficulty Easy (rss)
Root privileges Yes
Requirements None
Time 5m

  1. less command
  2. more command
  3. cat command
  4. grep command
  5. tail command
  6. zcat command
  7. zgrep command
  8. zmore command

How do I view log files on Linux?

Open the Terminal or login as root user using ssh command. Go to /var/log directory using the following cd command:
# cd /var/log

To list files use the following ls command:
# ls
Sample outputs from RHEL 6.x server:

anaconda.ifcfg.log    boot.log-20111225  cron-20131110.gz        maillog-20111218      messages-20131103.gz  secure-20131027.gz   spooler-20131117.gz  up2date-20131117.gz
anaconda.log          btmp               cron-20131117.gz        maillog-20111225      messages-20131110.gz  secure-20131103.gz   squid                uptrack.log
anaconda.program.log  btmp-20120101      cups                    maillog-20120101      messages-20131117.gz  secure-20131110.gz   swinstall.d          uptrack.log.1
anaconda.storage.log  btmp-20131101.gz   dkms_autoinstaller      maillog-20131027.gz   mysqld.log            secure-20131117.gz   tallylog             uptrack.log.2
anaconda.syslog       collectl           dmesg                   maillog-20131103.gz   ntpstats              setroubleshoot       UcliEvt.log          varnish
anaconda.yum.log      ConsoleKit         dmesg.old               maillog-20131110.gz   prelink               spooler              up2date              wtmp
arcconfig.xml         cron               dracut.log              maillog-20131117.gz   rhsm                  spooler-20111211     up2date-20111211     yum.log
atop                  cron-20111211      dracut.log-20120101     messages              sa                    spooler-20111218     up2date-20111218     yum.log-20120101
audit                 cron-20111218      dracut.log-20130101.gz  messages-20111211     secure                spooler-20111225     up2date-20111225     yum.log-20130101.gz
boot.log              cron-20111225      httpd                   messages-20111218     secure-20111211       spooler-20120101     up2date-20120101
boot.log-20111204     cron-20120101      lastlog                 messages-20111225     secure-20111218       spooler-20131027.gz  up2date-20131027.gz
boot.log-20111211     cron-20131027.gz   maillog                 messages-20120101     secure-20111225       spooler-20131103.gz  up2date-20131103.gz
boot.log-20111218     cron-20131103.gz   maillog-20111211        messages-20131027.gz  secure-20120101       spooler-20131110.gz  up2date-20131110.gz

To view a common log file called /var/log/messages use any one of the following command:
# less /var/log/messages
# more -f /var/log/messages
# cat /var/log/messages
# tail -f /var/log/messages
# grep -i error /var/log/messages

Sample outputs:

Jul 17 22:04:25 router  dnsprobe[276]: dns query failed
Jul 17 22:04:29 router last message repeated 2 times
Jul 17 22:04:29 router  dnsprobe[276]: Primary DNS server Is Down... Switching To Secondary DNS server
Jul 17 22:05:08 router  dnsprobe[276]: Switching Back To Primary DNS server
Jul 17 22:26:11 debian -- MARK --
Jul 17 22:46:11 debian -- MARK --
Jul 17 22:47:36 router  -- MARK --
Jul 17 22:47:36 router  dnsprobe[276]: dns query failed
Jul 17 22:47:38  debian kernel: rtc: lost some interrupts at 1024Hz.
Jun 17 22:47:39  debian kernel: IN=eth0 OUT= MAC=00:0f:ea:91:04:07:00:08:5c:00:00:01:08:00 SRC=61.4.218.24 DST=192.168.1.100 LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=21599 DF PROTO=TCP SPT=59297 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0

Common Linux log files names and usage

  • /var/log/messages : General message and system related stuff
  • /var/log/auth.log : Authenication logs
  • /var/log/kern.log : Kernel logs
  • /var/log/cron.log : Crond logs (cron job)
  • /var/log/maillog : Mail server logs
  • /var/log/qmail/ : Qmail log directory (more files inside this directory)
  • /var/log/httpd/ : Apache access and error logs directory
  • /var/log/lighttpd/ : Lighttpd access and error logs directory
  • /var/log/boot.log : System boot log
  • /var/log/mysqld.log : MySQL database server log file
  • /var/log/secure or /var/log/auth.log : Authentication log
  • /var/log/utmp or /var/log/wtmp : Login records file
  • /var/log/yum.log : Yum command log file.

GUI tool to view log files on Linux

System Log Viewer is a graphical, menu-driven viewer that you can use to view and monitor your system logs. This tool is only useful on your Linux powered laptop or desktop system. Most server do not have X Window system installed. You can start System Log Viewer in the following ways:

Click on System menu > Choose Administration > System Log:
Sample outputs:

Fig.01 Gnome log file viewer

A note about rsyslogd

All of the above logs are generated using rsyslogd service. It is a system utility providing support for message logging. Support of both internet and unix domain sockets enables this utility to support both local and remote logging. You can view its config file by tying the following command:
# vi /etc/rsyslog.conf
# ls /etc/rsyslog.d/

In short /var/log is the location where you should find all Linux logs file. However, some applications such as httpd have a directory within /var/log/ for their own log files. You can rotate log file using logrotate software and monitor logs files using logwatch software.

🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
87 comments… add one
  • Alperian Jan 6, 2015 @ 20:03

    I am stuck. I have the following response from my server:

    Running in FIPS 140-2 Mode
    Validating FIPS certified DLL…Passed

    Connecting to 79.77.3.238:22
    attempting 79.77.3.238:22… Success!
    Username: neilsftp
    Password:
    Authentication SUCCESS
    Remote Server Disconnected Unexpectedly

    No matter how I try to get in it authorizes me and dumps me.

  • Tausif Ahamd Jan 17, 2015 @ 11:07

    Really it helpful thanks a lot :)

  • ravi kiran Jul 13, 2015 @ 9:25

    Hi,

    i want to filter 40x,50x error and send to another file. please give the required command.
    thanku

  • Pulse Oct 23, 2015 @ 21:05

    THX!

  • Hoody Jan 13, 2016 @ 10:51

    Thanks ;)

  • Christine Liezel Mar 21, 2016 @ 7:50

    How to create a text file containing the logs of a specific folder?

  • Jaquice Jul 8, 2016 @ 18:40

    I have added my regular user ID to group root but I am still unable to read the file /var/log/secure. If a user is part of the group that can read this file, if I add a user to that group that ID should be able to read the file?

  • RAJA Mar 25, 2017 @ 4:26

    For example, if task 3 was to provide command configuring network interface eth0 so that the IP address was 192.168.0.2, network mask was 255.255.255.128 and the broadcast address was 192.168.0.255, you would enter the line as:

    3. ifconfig eth0 192.168.0.2 netmask 255.255.255.128 broadcast 192.168.0.255

    And if task 6 required you to show how a line defining alias called cp’ for command ‘cp -i’ you would enter into .bashrc file the following:

    6. alias cp=’cp -i’

    1. Which file you would use to redefine existing system variable PATH (provide full path)?

  • RAJA Mar 25, 2017 @ 4:27

    Hi any 1 can help me?

  • Nitin Krishna Dec 5, 2017 @ 7:25

    Really Helpful

  • Sheikh Dec 13, 2017 @ 13:11

    Very useful information thanks

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.