🧾 Linux/Unix: Logging Tools – journalctl, logger, and /var/log/ Explained
🧲 Introduction – Why Learn Linux Logging Tools?
Logging is crucial for Linux system administration, debugging, auditing, and security. Whether you’re a DevOps engineer or a sysadmin, tools like journalctl, logger, and files in /var/log/ help you monitor system behavior, track errors, and analyze performance issues in real-time or historically.
🎯 In this guide, you’ll learn:
- How Linux handles system logging
- How to query logs using
journalctl - How to create your own logs using
logger - How to navigate
/var/log/and its key files
📂 1. /var/log/ – The Traditional Log Directory
✅ What is /var/log/?
It is the central directory where most system logs are stored in plain text. These logs are readable by tools like less, tail, or cat.
📁 Common Files in /var/log/:
| File Name | Description |
|---|---|
/var/log/syslog | General system log (Debian/Ubuntu) |
/var/log/messages | General system log (RHEL/CentOS/Fedora) |
/var/log/auth.log | Authentication and security events |
/var/log/kern.log | Kernel messages |
/var/log/dmesg | Boot-time kernel ring buffer |
/var/log/cron | Cron job logs |
/var/log/Xorg.0.log | X Window system log |
/var/log/httpd/ | Apache web server logs |
🧪 Example: View last 50 lines of auth log
sudo tail -n 50 /var/log/auth.log
🧭 2. journalctl – View Logs from systemd Journal
✅ What is journalctl?
journalctl is used to query logs managed by systemd, replacing traditional log rotation in newer distros like Ubuntu 20+, Fedora, RHEL 7+, and Arch.
🛠️ Syntax:
journalctl [options]
🔹 Common journalctl Examples:
✅ View full system log:
journalctl
✅ View logs for today:
journalctl --since today
✅ View logs by boot:
journalctl -b
✅ Follow logs in real-time:
journalctl -f
✅ Show logs for a specific unit:
journalctl -u nginx.service
✅ Limit output by time:
journalctl --since "2025-06-15 09:00" --until "2025-06-15 10:00"
🧠 Logs include system services, boot processes, user sessions, and hardware events.
📝 3. logger – Write Custom Messages to Syslog
✅ What is logger?
logger allows users, scripts, or applications to write custom log entries to /var/log/syslog or the system journal.
🛠️ Syntax:
logger [options] "your message"
🧪 Example 1: Add simple log
logger "Backup script completed successfully."
✅ Appears in /var/log/syslog or journalctl.
🧪 Example 2: Add log with tag
logger -t BACKUP "MySQL backup completed"
📤 Output in journalctl or /var/log/syslog:
Jun 15 14:02:12 hostname BACKUP: MySQL backup completed
🔍 Tool Comparison
| Feature | /var/log/ | journalctl | logger |
|---|---|---|---|
| Log Source | Plain text files | systemd journal (binary) | Custom user/app logs |
| Rotation Support | ✅ (via logrotate) | Auto-managed by systemd | ✅ (sent to syslog/journal) |
| Real-time Viewing | tail -f | journalctl -f | ❌ (logs via other tools) |
| Custom Log Support | ❌ | ✅ | ✅ (via logger) |
📌 Summary – Recap & Next Steps
Linux logging tools help track system activity, debug errors, and maintain security logs. From the traditional /var/log/ directory to modern journalctl systems and custom logger messages, these tools provide powerful visibility into your system.
🔍 Key Takeaways:
- Use
journalctlfor querying systemd-based logs with rich filters. - Use
loggerto send script or manual messages to syslog. - Use
/var/log/for text-based system and service logs.
❓ FAQs
❓ Where are logs stored on systemd-based systems?
✅ Mostly in a binary journal managed by systemd. Use journalctl to read them.
❓ How can I filter logs for a specific service?
✅ Use:
journalctl -u sshd
❓ Can I make logger write to a custom file?
🟡 Not directly. You’ll need to configure rsyslog to redirect logs based on tags.
❓ How do I clear systemd logs?
✅ Use:
sudo journalctl --vacuum-time=2weeks
❓ What’s the default log retention for journal logs?
🧠 It varies, but usually systemd rotates logs based on disk size and time. Configurable in /etc/systemd/journald.conf.
Share Now :
