When your systems are running smoothly, take some time to learn and understand the content of various log files, which will help you when there is a crisis and you have to look though the log files to identify the issue. The operating system and running applications constantly create different types of messages that are registered in different log files.<\/p>\n
Open the Terminal or login as root user using ssh command. Go to \/var\/log directory using the following cd command:<\/p>\n
# cd \/var\/log<\/pre>\nTo list files use the following ls command:<\/p>\n
# ls<\/pre>\nTo view the log files use any one of the following methods:<\/p>\n
vi<\/b>\u00a0\u2013 If you are comfortable with the vi commands, use vi editor for quick log file browsing.
\ntail<\/b>\u00a0\u2013 If you want to view the content of the log files real time, as the application is writting to it, use \u201ctail -f\u201d. You can also view multiple log files at the same time (using \u201ctail -f\u201d).
\ngrep<\/b>\u00a0\u2013 If you know exactly what you are looking for in a log file, you can quickly use grep command to grep a pattern. The 15 practical grep examples will take out all your excuses of not using grep.
\nless<\/b>\u00a0\u2013 Less command is very powerful to browse log files. Use these 10 less command tips to master the less command.<\/p>\n\/var\/log\/messages<\/a>\u00a0\u2013 Contains global system messages, including the messages that are logged during system startup. There are several things that are logged in \/var\/log\/messages including mail, cron, daemon, kern, auth, etc.<\/p>\n
\u00a0\/var\/log\/auth.log<\/a>\u00a0\u2013 Contains system authorization information, including user logins and authentication mechanism that were used.<\/p>\n
\/var\/log\/kern.log \u2013 Contains information logged by the kernel. Helpful for you to troubleshoot a custom-built kernel.<\/p>\n
\/var\/log\/cron<\/a>\u00a0\u2013 Whenever cron daemon (or anacron) starts a cron job, it logs the information about the cron job in this file<\/p>\n
\/var\/log\/secure \u2013 Contains information related to authentication and authorization privileges. For example, sshd logs all the messages here, including unsuccessful login.<\/p>\n
\/var\/log\/dmesg<\/a>\u00a0\u2013 Contains kernel ring buffer information. When the system boots up, it prints number of messages on the screen that displays information about the hardware devices that the kernel detects during boot process. These messages are available in kernel ring buffer and whenever the new message comes the old message gets overwritten. You can also view the content of this file using the dmesg command.<\/p>\n
\/var\/log\/boot.log\u00a0<\/a>\u2013 Contains information that are logged when the system boots<\/p>\n
\/var\/log\/daemon.log \u2013 Contains information logged by the various background daemons that runs on the system<\/p>\n
\/var\/log\/dpkg.log \u2013 Contains information that are logged when a package is installed or removed using dpkg command<\/p>\n
\/var\/log\/lastlog \u2013 Displays the recent login information for all the users. This is not an ascii file. You should use lastlog command to view the content of this file.<\/p>\n
\/var\/log\/maillog \/var\/log\/mail.log \u2013 Contains the log information from the mail server that is running on the system. For example, sendmail logs information about all the sent items to this file<\/p>\n
\/var\/log\/user.log \u2013 Contains information about all user level logs<\/p>\n
\/var\/log\/Xorg.x.log \u2013 Log messages from the X<\/p>\n
\/var\/log\/alternatives.log \u2013 Information by the update-alternatives are logged into this log file. On Ubuntu, update-alternatives maintains symbolic links determining default commands.<\/p>\n
\/var\/log\/btmp \u2013 This file contains information about failed login attemps. Use the last command to view the btmp file. For example, \u201clast -f \/var\/log\/btmp | more\u201d<\/p>\n
\/var\/log\/cups \u2013 All printer and printing related log messages<\/p>\n
\/var\/log\/anaconda.log \u2013 When you install Linux, all installation related messages are stored in this log file<\/p>\n
\/var\/log\/yum.log \u2013 Contains information that are logged when a package is installed using yum<\/p>\n
\/var\/log\/wtmp or \/var\/log\/utmp \u2013 Contains login records. Using wtmp you can find out who is logged into the system. who command uses this file to display the information.<\/p>\n
\/var\/log\/faillog \u2013 Contains user failed login attemps. Use faillog command to display the content of this file.<\/p>\n
\/var\/log\/httpd\/\u00a0<\/a>(or) \/var\/log\/apache2 \u2013 Contains the apache web server access_log and error_log<\/p>\n
\/var\/log\/lighttpd\/ \u2013 Contains light HTTPD access_log and error_log<\/p>\n
\/var\/log\/conman\/ \u2013 Log files for ConMan client. conman connects remote consoles that are managed by conmand daemon.<\/p>\n
\/var\/log\/mail\/ \u2013 This subdirectory contains additional logs from your mail server. For example, sendmail stores the collected mail statistics in \/var\/log\/mail\/statistics file<\/p>\n
\/var\/log\/prelink\/ \u2013 prelink program modifies shared libraries and linked binaries to speed up the startup process. \/var\/log\/prelink\/prelink.log contains the information about the .so file that was modified by the prelink.<\/p>\n
\/var\/log\/audit\/\u00a0<\/a>\u2013 Contains logs information stored by the Linux audit daemon (auditd).<\/p>\n
\/var\/log\/setroubleshoot\/ \u2013 SELinux uses setroubleshootd (SE Trouble Shoot Daemon) to notify about issues in the security context of files, and logs those information in this log file.<\/p>\n
\/var\/log\/samba\/\u00a0<\/a>\u2013 Contains log information stored by samba, which is used to connect Windows to Linux.<\/p>\n