Where Are Linux Logs? Key /var/log Files and Viewing Them with last, tail, and grep

Linux systems generate various log files to record system activity, errors, and security events. These log files are essential for system monitoring, troubleshooting, and security auditing. For who is actually allowed to read these log files, see The Complete Guide to Linux Permissions .

Key Log Files

Log files are typically stored under the /var/log directory.

1. /var/log/messages (or syslog)

• Content: Records general system-wide information, kernel messages, messages from system daemons, hardware-related events, etc.
• Location: The filename varies by distribution.
  • Red Hat-based (CentOS, Fedora): /var/log/messages
  • Debian-based (Ubuntu): /var/log/syslog

2. /var/log/secure (or auth.log)

• Content: Records authentication events and security-related information. Includes login attempts, sudo command executions, SSH connections, etc.
• Location:
  • Red Hat-based: /var/log/secure
  • Debian-based: /var/log/auth.log

3. /var/log/wtmp

• Content: Records system login and logout history. Stored in binary format and cannot be read directly with a text editor.
• Viewing command: last

  last
  

  This command displays user login/logout history, system reboot history, etc.

4. /var/run/utmp (or /var/log/utmp)

• Content: Records information about currently logged-in users. Also in binary format.
• Viewing commands: who, w, users

  who    # List of currently logged-in users
  w      # Currently logged-in users and the processes they are running
  users  # Only the names of currently logged-in users
  

5. /var/log/lastlog

• Content: Records the last login time for each user. Also in binary format.
• Viewing command: lastlog

  lastlog
  

  This command displays the last login information for all users on the system.

Viewing and Managing Log Files

Log files grow over time and require regular management.

• Real-time monitoring: Using the tail command with the -f option, such as tail -f /var/log/syslog, displays content appended to the end of the log file in real time.
• Searching: The grep command can be used to search for lines containing specific keywords.

  grep "error" /var/log/messages
  

• Paging: The less or more commands can be used to browse long log files page by page.

  less /var/log/secure
  

• Log rotation: The logrotate service periodically compresses, deletes, or rotates log files to manage disk space consumption. Configuration is done in /etc/logrotate.conf and files within the /etc/logrotate.d/ directory.

Understanding these log files and commands enables you to maintain Linux system health and respond quickly when issues arise.

FAQ

Q. What’s the difference between /var/log/messages and /var/log/secure? A. /var/log/messages (syslog on Debian-based systems) records general system-wide information and kernel messages. /var/log/secure (auth.log on Debian-based systems) records authentication and security-related events, such as login attempts, sudo command executions, and SSH connections.

Q. How do I monitor a log file in real time? A. Use tail with the -f option, e.g. tail -f /var/log/syslog, to display content as it’s appended to the end of the log file. To follow only certain keywords, combine it with grep, e.g. grep "error" /var/log/messages.

Q. What keeps log files from growing indefinitely? A. The logrotate service periodically compresses, deletes, or rotates log files to keep disk usage in check. It’s configured via /etc/logrotate.conf and files inside the /etc/logrotate.d/ directory.

Related Books

More field-by-field book recommendations are collected in 10 Recommended Technical Books for Engineers .