Linux Log Files

Where Linux Keeps Its Log Files

Linux log files are records that programs write about what happens on a system. Each entry typically includes a timestamp, the program that produced it and a message. Logs are the first place to look when a service fails, a login is refused or a site returns errors.

Most log files live in /var/log, a directory defined by the Filesystem Hierarchy Standard for variable data that grows over time. Its contents depend on the distribution and the software installed. Traditionally, a system logger called syslog receives messages from the kernel and services and sorts them into text files. Common examples are /var/log/syslog on Debian-based systems and /var/log/messages on Red Hat-based systems.

Systems that use systemd also keep messages in a binary journal managed by journald, which is read with the journalctl command. How this fits with the rest of the service manager is covered in the systemd guide.

The Main Log Types on a Web Server

A web server produces several kinds of logs, and each answers a different question:

• System logs: boot messages, kernel events, hardware warnings and general service activity.
• Authentication logs: records of logins, failed attempts and use of sudo. On Debian-based systems this is usually /var/log/auth.log; on Red Hat-based systems it is often /var/log/secure.
• Web server logs: an access log that records each request, and an error log that records problems. Apache and Nginx keep their own logs in subdirectories of /var/log.
• Mail logs: the activity of a mail server, such as messages accepted, delivered or deferred.

The access log shows which pages were requested and from which address, while the error log explains why a request failed. Reading both together usually gives a clearer picture than either one alone.

Why Log Rotation Keeps Disks From Filling

Logs grow every day, and a busy server can produce a large volume of text in a short time. Log rotation is the regular process of renaming the current log, compressing older copies and deleting the oldest ones once a set limit is reached. On many distributions the logrotate tool handles this, usually run once a day by the scheduler.

Without rotation, a log can fill the disk partition that holds it. A full disk can stop databases from writing, block uploads and make a server behave as if it has crashed. Rotation settings also decide how long logs are kept, which matters when you need to investigate an event that happened weeks earlier. For the scheduled jobs that often trigger rotation, see how cron schedules are written.