When you encounter server operation issues, first check the logs, as they may indicate the cause. The operating system and running applications use different log files, which are stored in different locations.
In this tutorial, we cover the most common log file locations on a server and explain what information these files store.
Prerequisites
OpenVZ or KVM virtualized servers running a Linux operating system.
Viewing Logs
Connect to the server via SSH as the root user. Open the /var/log/ directory using the following command:
cd /var/log
To display the list of files, use:
ls
You can use the following methods to view log files:
vi – if you are comfortable using the vi text editor, you can use it to view log files.
tail – if you want to monitor a log file in real time, including while it is being updated by the system, use tail -f. You can also monitor multiple log files at the same time.
grep – if you know exactly what you are looking for in a log file, you can use the grep command to find specific text.
less – this command is very useful for browsing and searching log files. It displays a manageable amount of content at a time, making large logs easier to review.
/var/log/messages – contains general system messages, including messages recorded during system startup. This file commonly contains messages related to mail, scheduled tasks, daemons, the kernel, authorization, and other system services.
/var/log/auth.log – contains system authentication logs, including user login information and the authentication mechanisms used.
/var/log/kern.log (KVM only) – contains information generated by the server kernel. This can be useful when a non-standard kernel is being used.
/var/log/cron – contains logs related to scheduled task (cron job) execution.
/var/log/secure – contains authentication and authorization-related information. For example, sshd stores authentication messages in this file, including failed login attempts.
/var/log/dmesg (KVM only) – contains information from the kernel ring buffer. When the system boots, it generates many messages with information about the hardware the kernel detects during the boot process. After another reboot, newer messages may overwrite older ones. You can also view this information using the dmesg command.
/var/log/boot.log – contains information related to the system boot process.
/var/log/daemon.log – contains information about various daemons and services running in the background.
/var/log/dpkg.log – contains information about packages installed or removed using the dpkg package manager.
/var/log/lastlog – contains information about the most recent login of every user. This is not an ASCII text file, so you should use the lastlog command to view its contents.
/var/log/maillog or /var/log/mail.log – contains information generated by the mail server on the system, including sent and received messages and mail delivery activity.
/var/log/user.log – contains information related to user activity and user-generated system messages.
/var/log/Xorg.x.log – contains information generated by the X.Org display server.
/var/log/alternatives.log – contains information about the alternatives system. On Ubuntu, the alternatives system uses symbolic links to manage different versions or implementations of standard commands.
/var/log/btmp – contains information about failed login attempts. This is a binary file and can be viewed using the last command. For example:
last -f /var/log/btmp | more
/var/log/cups/ – contains logs related to printers and printing operations.
/var/log/anaconda.log – contains installation-related messages generated when installing a Linux operating system using the Anaconda installer.
/var/log/yum.log – contains information recorded when packages are installed, updated, or removed using the yum package manager.
/var/log/wtmp and /var/log/utmp – contain user login and session information. wtmp stores historical login and logout information, while utmp contains information about users who are currently logged in.
/var/log/faillog – contains information about failed user login attempts. You can use the faillog command to view its contents.
/var/log/httpd/ or /var/log/apache2/ – contains Apache web server access and error logs.
/var/log/lighttpd/ – contains Lighttpd web server access and error logs.
/var/log/conman/ – contains logs generated by the ConMan console management system. ConMan manages remote console connections through the ConMan daemon.
/var/log/mail/ – this subdirectory contains additional logs generated by the mail server.
/var/log/prelink/ – the prelink utility modifies shared libraries and executable binaries to improve application startup performance. The /var/log/prelink/prelink.log file contains information about .so files modified by prelink.
/var/log/audit/ – contains information recorded by the Linux Audit daemon.
/var/log/setroubleshoot/ – contains information generated by SELinux troubleshooting tools, which help identify and diagnose SELinux-related security issues.
/var/log/samba/ – contains logs generated by the Samba service, which provides file and printer sharing between Linux and Windows systems.
/var/log/sa/ – contains daily sar system activity files generated by the sysstat package.
/var/log/sssd/ – contains logs generated by the System Security Services Daemon (SSSD), which manages access to remote identity directories and authentication mechanisms.