← Logs & Journald
Linux · Logs & Journald

How to read system log files in /var/log in Linux

Read the traditional system log files under /var/log (messages, secure, syslog, auth.log) with tail, less, grep, and zgrep.


Read the plain-text logs under /var/log. RHEL / Oracle Linux use /var/log/messages and /var/log/secure; Debian / Ubuntu use /var/log/syslog and /var/log/auth.log.

# General system messages
sudo tail -n 100 /var/log/messages     # RHEL/OL
sudo tail -n 100 /var/log/syslog       # Debian/Ubuntu

# Authentication / sudo / SSH
sudo tail -n 100 /var/log/secure       # RHEL/OL
sudo tail -n 100 /var/log/auth.log     # Debian/Ubuntu

# Follow a log as it grows
sudo tail -f /var/log/messages

# Search a log, including rotated .gz copies
sudo grep -i error /var/log/messages
sudo zgrep -i error /var/log/messages-*.gz

# What logs exist
ls -lh /var/log/
LinuxLogs/var/log