🧾 Linux/Unix: Logging Tools – journalctl, logger, and /var/log/ Explained

🧲 Introduction – Why Learn Linux Logging Tools?

Logging is crucial for Linux system administration, debugging, auditing, and security. Whether you’re a DevOps engineer or a sysadmin, tools like journalctl, logger, and files in /var/log/ help you monitor system behavior, track errors, and analyze performance issues in real-time or historically.

🎯 In this guide, you’ll learn:

• How Linux handles system logging
• How to query logs using journalctl
• How to create your own logs using logger
• How to navigate /var/log/ and its key files

---

📂 1. /var/log/ – The Traditional Log Directory

✅ What is /var/log/?

It is the central directory where most system logs are stored in plain text. These logs are readable by tools like less, tail, or cat.

---

📁 Common Files in /var/log/:

File Name	Description
/var/log/syslog	General system log (Debian/Ubuntu)
/var/log/messages	General system log (RHEL/CentOS/Fedora)
/var/log/auth.log	Authentication and security events
/var/log/kern.log	Kernel messages
/var/log/dmesg	Boot-time kernel ring buffer
/var/log/cron	Cron job logs
/var/log/Xorg.0.log	X Window system log
/var/log/httpd/	Apache web server logs

---

🧪 Example: View last 50 lines of auth log

sudo tail -n 50 /var/log/auth.log

---

🧭 2. journalctl – View Logs from systemd Journal

✅ What is journalctl?

journalctl is used to query logs managed by systemd, replacing traditional log rotation in newer distros like Ubuntu 20+, Fedora, RHEL 7+, and Arch.

---

🛠️ Syntax:

journalctl [options]

---

🔹 Common journalctl Examples:

✅ View full system log:

journalctl

✅ View logs for today:

journalctl --since today

✅ View logs by boot:

journalctl -b

✅ Follow logs in real-time:

journalctl -f

✅ Show logs for a specific unit:

journalctl -u nginx.service

✅ Limit output by time:

journalctl --since "2025-06-15 09:00" --until "2025-06-15 10:00"

🧠 Logs include system services, boot processes, user sessions, and hardware events.

---

📝 3. logger – Write Custom Messages to Syslog

✅ What is logger?

logger allows users, scripts, or applications to write custom log entries to /var/log/syslog or the system journal.

---

🛠️ Syntax:

logger [options] "your message"

---

🧪 Example 1: Add simple log

logger "Backup script completed successfully."

✅ Appears in /var/log/syslog or journalctl.

---

🧪 Example 2: Add log with tag

logger -t BACKUP "MySQL backup completed"

📤 Output in journalctl or /var/log/syslog:

Jun 15 14:02:12 hostname BACKUP: MySQL backup completed

---

🔍 Tool Comparison

Feature	/var/log/	journalctl	logger
Log Source	Plain text files	systemd journal (binary)	Custom user/app logs
Rotation Support	✅ (via logrotate)	Auto-managed by systemd	✅ (sent to syslog/journal)
Real-time Viewing	tail -f	journalctl -f	❌ (logs via other tools)
Custom Log Support	❌	✅	✅ (via logger)

---

📌 Summary – Recap & Next Steps

Linux logging tools help track system activity, debug errors, and maintain security logs. From the traditional /var/log/ directory to modern journalctl systems and custom logger messages, these tools provide powerful visibility into your system.

🔍 Key Takeaways:

• Use journalctl for querying systemd-based logs with rich filters.
• Use logger to send script or manual messages to syslog.
• Use /var/log/ for text-based system and service logs.

---

❓ FAQs

❓ Where are logs stored on systemd-based systems?
✅ Mostly in a binary journal managed by systemd. Use journalctl to read them.

❓ How can I filter logs for a specific service?
✅ Use:

journalctl -u sshd

❓ Can I make logger write to a custom file?
🟡 Not directly. You’ll need to configure rsyslog to redirect logs based on tags.

❓ How do I clear systemd logs?
✅ Use:

sudo journalctl --vacuum-time=2weeks

❓ What’s the default log retention for journal logs?
🧠 It varies, but usually systemd rotates logs based on disk size and time. Configurable in /etc/systemd/journald.conf.

---

Share Now :