{"id":6432,"date":"2023-08-28T17:26:57","date_gmt":"2023-08-28T17:26:57","guid":{"rendered":"https:\/\/www.webhi.com\/how-to\/?p=6432"},"modified":"2023-08-28T17:26:59","modified_gmt":"2023-08-28T17:26:59","slug":"how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems","status":"publish","type":"post","link":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/","title":{"rendered":"How to access and configure System Logs on Ubuntu and Debian Systems"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1200\" height=\"675\" src=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en.jpg\" alt=\"Managing and accessing system logs on Linux\" class=\"wp-image-6443\" srcset=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en.jpg 1200w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en-300x169.jpg 300w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en-1024x576.jpg 1024w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en-768x432.jpg 768w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en-150x84.jpg 150w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"introduction\">Introduction<\/h2>\n\n\n\n<p>System administrators working with <strong>Ubuntu and Debian<\/strong> often need to consult log files to troubleshoot issues. This is a fundamental step in diagnosing and resolving problems on these operating systems.<\/p>\n\n\n\n<p>Linux-based systems, including Ubuntu and Debian, generate a variety of messages that are recorded in log files. These log messages are crucial for understanding the system&#8217;s behavior and identifying issues. Linux relies on a combination of configuration files, directories, programs, commands, and daemons to manage and organize these log messages. Familiarity with the locations of log files and the associated commands can significantly expedite the troubleshooting process.<\/p>\n\n\n\n<p>In this guide, we will explore the key aspects of the Linux logging system in the context of Ubuntu and Debian.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-1---identifying-default-log-file-locations\">Step 1 &#8211; Identifying Default Log File Locations<\/h2>\n\n\n\n<p>By default, log files on Ubuntu and Debian are stored in the&nbsp;<code>\/var\/log<\/code>&nbsp;directory. You can view the list of log files in this directory using the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ ls -l \/var\/log<\/code><\/pre>\n\n\n\n<p>When executed on your system, the output will resemble the following:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">total 49316\ndrwxr-xr-x. 2 root   root          6 Sep 27 19:17 anaconda\ndrwx------. 2 root   root         99 Jan  3 08:23 audit\n-rw-rw----. 1 root   utmp    1234560 Jan  3 16:16 btmp\n-rw-rw----. 1 root   utmp   17305344 Jan  1 00:00 btmp-20230101\ndrwxr-x---. 2 chrony chrony        6 Aug 10  2021 chrony\n-rw-r--r--. 1 root   root     130466 Dec  8 22:12 cloud-init.log\n-rw-r-----. 1 root   adm       10306 Dec  8 22:12 cloud-init-output.log\n-rw-------. 1 root   root      36979 Jan  3 16:03 cron\n-rw-------. 1 root   root      27360 Dec 10 23:15 cron-20221211\n-rw-------. 1 root   root      94140 Dec 17 23:07 cron-20221218\n-rw-------. 1 root   root      95126 Dec 24 23:14 cron-20221225\n-rw-------. 1 root   root      95309 Dec 31 23:04 cron-20230101\n\u2026<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-2---viewing-log-contents\">Step 2 &#8211; Viewing Log Contents<\/h2>\n\n\n\n<p>Under&nbsp;<code>\/var\/log<\/code>, you&#8217;ll encounter various log files with specific purposes. Some common examples include:<\/p>\n\n\n\n<ul>\n<li><code>wtmp<\/code><\/li>\n\n\n\n<li><code>utmp<\/code><\/li>\n\n\n\n<li><code>dmesg<\/code><\/li>\n\n\n\n<li><code>messages<\/code><\/li>\n\n\n\n<li><code>maillog<\/code>&nbsp;or&nbsp;<code>mail.log<\/code><\/li>\n\n\n\n<li><code>spooler<\/code><\/li>\n\n\n\n<li><code>auth.log<\/code>&nbsp;or&nbsp;<code>secure<\/code><\/li>\n<\/ul>\n\n\n\n<p><code>wtmp<\/code>&nbsp;and&nbsp;<code>utmp<\/code>&nbsp;files track user logins and logouts. To see the currently logged-in users on a Linux server, use the&nbsp;<code>who<\/code>&nbsp;command. On Ubuntu, the output could look like this:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@ubuntu-22:~# who\nroot     pts\/0        2023-01-03 16:23 (198.7.211.4)<\/code><\/pre>\n\n\n\n<p>To retrieve login history, the&nbsp;<code>last<\/code>&nbsp;command is useful:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@ubuntu-22:~# last\nroot     pts\/0        198.7.211.4  Tue Jan  3 16:23   still logged in\nreboot   system boot  5.19.0-23-generi Thu Dec  8 21:48   still running\n\nwtmp begins Thu Dec  8 21:48:51 2022<\/code><\/pre>\n\n\n\n<p>For determining the last reboot time, use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ last reboot<\/code><\/pre>\n\n\n\n<p>In Debian, the output might appear as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@debian-11-trim:~# last reboot\nreboot   system boot  5.10.0-11-amd64  Thu Dec  8 21:49   still running\n\nwtmp begins Thu Dec  8 21:49:39 2022<\/code><\/pre>\n\n\n\n<p>The&nbsp;<code>lastlog<\/code>&nbsp;command can reveal the last login times for users:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ lastlog<\/code><\/pre>\n\n\n\n<p>Output on a Debian system might resemble:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@debian-11-trim:~# lastlog\nUsername         Port     From             Latest\nroot             pts\/0    162.243.188.66   Tue Jan  3 16:23:03 +0000 2023\ndaemon                                     **Never logged in**\nbin                                        **Never logged in**\nsys                                        **Never logged in**\nsync                                       **Never logged in**\ngames                                      **Never logged in**\nman                                        **Never logged in**\nlp                                         **Never logged in**\nmail                                       **Never logged in**\nnews                                       **Never logged in**\nuucp                                       **Never logged in**\nproxy                                      **Never logged in**\nwww-data                                   **Never logged in**\nbackup                                     **Never logged in**\nlist                                       **Never logged in**\nirc                                        **Never logged in**\ngnats                                      **Never logged in**\nnobody                                     **Never logged in**\n_apt                                       **Never logged in**\nmessagebus                                 **Never logged in**\nuuidd                                      **Never logged in**\n\u2026<\/code><\/pre>\n\n\n\n<p>To access the contents of text-based log files, commands like&nbsp;<code>cat<\/code>,&nbsp;<code>head<\/code>, or&nbsp;<code>tail<\/code>&nbsp;can be employed. For example, to view the last ten lines of the&nbsp;<code>\/var\/log\/messages<\/code>&nbsp;file on a Debian server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo tail \/var\/log\/messages<\/code><\/pre>\n\n\n\n<p>Expected output:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">root@debian-11-trim:~# tail \/var\/log\/messages\nJan  1 00:10:14 debian-11-trim rsyslogd: [origin software=\"rsyslogd\" swVersion=\"8.2102.0\" x-pid=\"30025\" x-info=\"https:\/\/www.rsyslog.com\"] rsyslogd was HUPed\nJan  3 16:23:01 debian-11-trim DropletAgent[808]: INFO:2023\/01\/03 16:23:01 ssh_watcher.go:65: [SSH Watcher] Port knocking detected.\nJan  3 16:23:01 debian-11-trim DropletAgent[808]: INFO:2023\/01\/03 16:23:01 do_managed_keys_actioner.go:43: [DO-Managed Keys Actioner] Metadata contains 1 ssh keys and 1 dotty keys\nJan  3 16:23:01 debian-11-trim DropletAgent[808]: INFO:2023\/01\/03 16:23:01 do_managed_keys_actioner.go:49: [DO-Managed Keys Actioner] Attempting to update 1 dotty keys\nJan  3 16:23:01 debian-11-trim DropletAgent[808]: INFO:2023\/01\/03 16:23:01 do_managed_keys_actioner.go:65: [DO-Managed Keys Actioner] Attempting to create 1 ssh keys\nJan  3 16:23:01 debian-11-trim DropletAgent[808]: INFO:2023\/01\/03 16:23:01 do_managed_keys_actioner.go:105: [DO-Managed Keys Actioner] Action metadata updated\nJan  3 16:23:02 debian-11-trim kernel: [   22.685314] Bluetooth: RFCOMM TTY layer initialized\nJan  3 16:23:02 debian-11-trim kernel: [   22.685320] Bluetooth: RFCOMM socket layer initialized\nJan  3 16:23:02 debian-11-trim kernel: [   22.685321] Bluetooth: RFCOMM ver 1.11\nJan  3 16:23:03 debian-11-trim login[956]: ROOT LOGIN  on '\/dev\/pts\/0'<\/code><\/pre>\n\n\n\n<p>For logs that update in real-time, the&nbsp;<code>tail -f<\/code>&nbsp;command can be used to &#8220;follow&#8221; the log and display new entries as they are added:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo tail -f \/var\/log\/syslog<\/code><\/pre>\n\n\n\n<p>To view the beginning of a log file, use&nbsp;<code>head<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo head \/var\/log\/syslog<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-3---using-logrotate-for-log-management\">Step 3 &#8211; Using Logrotate for Log Management<\/h2>\n\n\n\n<p>The&nbsp;<code>logrotate<\/code>&nbsp;utility automates the management of log files. It can archive old log files, compress logs, and clean up log directories to prevent excessive disk usage.<\/p>\n\n\n\n<p>To configure&nbsp;<code>logrotate<\/code>, edit the&nbsp;<code>\/etc\/logrotate.conf<\/code>&nbsp;file using a text editor (such as&nbsp;<code>nano<\/code>&nbsp;or&nbsp;<code>vim<\/code>). The&nbsp;<code>logrotate<\/code>&nbsp;configuration file is well-commented and provides clear guidelines on how to set up rotation rules for log files.<\/p>\n\n\n\n<p>Here&#8217;s an example of what the configuration file might look like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># see \"man logrotate\" for details\n# rotate log files weekly\nweekly\n\n# keep 4 weeks worth of backlogs\nrotate 4\n\n# create new (empty) log files after rotating old ones\ncreate\n\n# use date as a suffix of the rotated file\ndateext\n\n# uncomment this if you want your log files compressed\n# compress\n\n# packages drop log rotation information into this directory\ninclude \/etc\/logrotate.d\n\n# no packages own wtmp, or btmp -- we'll rotate them here\n\/var\/log\/wtmp {\n    missingok\n    monthly\n    create 0664 root utmp\n    minsize 1M\n    rotate 1\n}\n\n\/var\/log\/btmp {\n    missingok\n    monthly\n    create 0660 root utmp\n    rotate 1\n}\n\n# system-specific logs may be also be configured here<\/code><\/pre>\n\n\n\n<p>In this example, log files are rotated weekly, kept for a total of 4 weeks, and new log files are created after rotation. Additionally, log files are compressed after rotation.<\/p>\n\n\n\n<p>To add or edit specific log rotation rules, you can create or edit files in the&nbsp;<code>\/etc\/logrotate.d<\/code>&nbsp;directory. For instance, a file named&nbsp;<code>\/etc\/logrotate.d\/nginx<\/code>&nbsp;would contain rules specifically for rotating the Nginx web server logs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"step-4---using-the-rsyslog-daemon\">Step 4 &#8211; Using the&nbsp;<code>rsyslog<\/code>&nbsp;Daemon<\/h2>\n\n\n\n<p>The&nbsp;<code>rsyslog<\/code>&nbsp;daemon is a powerful and flexible system logging service available on Ubuntu and Debian systems. It replaces the older&nbsp;<code>syslog<\/code>&nbsp;system and provides advanced features for handling log messages.&nbsp;<code>rsyslog<\/code>&nbsp;allows you to filter, route, and store log messages in various formats and destinations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"installation-and-basic-configuration\">Installation and Basic Configuration<\/h3>\n\n\n\n<ol>\n<li><strong>Installation<\/strong>:<\/li>\n<\/ol>\n\n\n\n<p>Check if&nbsp;<code>rsyslog<\/code>&nbsp;is already installed on your system by running:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo dpkg -l | grep rsyslog<\/code><\/pre>\n\n\n\n<p>If it&#8217;s not installed, you can install it using the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo apt-get update\n$ sudo apt-get install rsyslog<\/code><\/pre>\n\n\n\n<ol start=\"2\">\n<li><strong>Configuration Files<\/strong>:<\/li>\n<\/ol>\n\n\n\n<p><code>rsyslog<\/code>&#8216;s main configuration file is located at&nbsp;<code>\/etc\/rsyslog.conf<\/code>. However, it&#8217;s recommended to make configuration changes in separate files in the&nbsp;<code>\/etc\/rsyslog.d\/<\/code>&nbsp;directory to keep things organized and avoid directly modifying the main file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"understanding-configuration-lines\">Understanding Configuration Lines<\/h3>\n\n\n\n<p>The&nbsp;<code>rsyslog.conf<\/code>&nbsp;file consists of a series of configuration lines, each comprising a two-part instruction: a&nbsp;<strong>selector<\/strong>&nbsp;and an&nbsp;<strong>action<\/strong>. These parts are separated by white space.<\/p>\n\n\n\n<ol>\n<li><strong>Selector<\/strong>: The selector part determines the source and importance of the log message. It is divided into two components by a dot (<code>.<\/code>):\n<ul>\n<li><strong>Facility<\/strong>: Denotes the origin of the message, such as&nbsp;<code>auth<\/code>,&nbsp;<code>kern<\/code>,&nbsp;<code>mail<\/code>,&nbsp;<code>user<\/code>, etc.<\/li>\n\n\n\n<li><strong>Priority<\/strong>: Represents the severity level of the message, ranging from&nbsp;<code>debug<\/code>&nbsp;(lowest) to&nbsp;<code>emerg<\/code>&nbsp;(highest).<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Action<\/strong>: The action part specifies what&nbsp;<code>rsyslog<\/code>&nbsp;should do with log messages that match the provided selector. This can involve writing messages to specific log files, forwarding them to remote servers, and more.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-configuration-line\">Example Configuration Line<\/h3>\n\n\n\n<p>Here&#8217;s an example of a configuration line that logs kernel messages (<code>kern<\/code>) of priority&nbsp;<code>err<\/code>&nbsp;(error) level:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"properties\" class=\"language-properties\">kern.err        \/var\/log\/kernel_errors.log<\/code><\/pre>\n\n\n\n<p>In this example:<\/p>\n\n\n\n<ul>\n<li><code>kern.err<\/code>&nbsp;is the selector, indicating that it&#8217;s for kernel messages of error priority.<\/li>\n\n\n\n<li><code>\/var\/log\/kernel_errors.log<\/code>&nbsp;is the action, specifying that matching log messages should be saved to the&nbsp;<code>kernel_errors.log<\/code>&nbsp;file.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"viewing-configuration-files\">Viewing Configuration Files<\/h3>\n\n\n\n<p>On Ubuntu systems, the default configuration file is often found at&nbsp;<code>\/etc\/rsyslog.d\/50-default.conf<\/code>. You can use the following command to view its contents:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ cat \/etc\/rsyslog.d\/50-default.conf<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"facilities-and-priorities\">Facilities and Priorities<\/h3>\n\n\n\n<p>Different&nbsp;<strong>facilities<\/strong>&nbsp;represent various sources of log messages, such as&nbsp;<code>auth<\/code>,&nbsp;<code>kern<\/code>,&nbsp;<code>mail<\/code>, and more. Each message is assigned a&nbsp;<strong>priority<\/strong>&nbsp;indicating its severity level, ranging from&nbsp;<code>debug<\/code>&nbsp;(lowest) to&nbsp;<code>emerg<\/code>&nbsp;(highest).<\/p>\n\n\n\n<p>Here are a few facilities and priorities recognized by&nbsp;<code>rsyslog<\/code>:<\/p>\n\n\n\n<p><strong>Facilities<\/strong>:<\/p>\n\n\n\n<ul>\n<li><code>auth<\/code>&nbsp;or&nbsp;<code>authpriv<\/code>: Authorization and security-related events<\/li>\n\n\n\n<li><code>user<\/code>: Log messages coming from user programs<\/li>\n\n\n\n<li><code>mail<\/code>: Log messages generated by the mail subsystem<\/li>\n\n\n\n<li><code>local0<\/code>&nbsp;to&nbsp;<code>local7<\/code>: Reserved for local use<\/li>\n\n\n\n<li><code>kern<\/code>: Messages originating from the Linux kernel<\/li>\n<\/ul>\n\n\n\n<p><strong>Priorities<\/strong>:<\/p>\n\n\n\n<ul>\n<li><code>debug<\/code>: Debug information from programs<\/li>\n\n\n\n<li><code>info<\/code>: Simple informational messages<\/li>\n\n\n\n<li><code>notice<\/code>: Conditions that may require attention<\/li>\n\n\n\n<li><code>warn<\/code>: Warnings<\/li>\n\n\n\n<li><code>err<\/code>: Errors<\/li>\n\n\n\n<li><code>crit<\/code>: Critical conditions<\/li>\n\n\n\n<li><code>alert<\/code>: Conditions that need immediate intervention<\/li>\n\n\n\n<li><code>emerg<\/code>: Emergency conditions<\/li>\n<\/ul>\n\n\n\n<p>Understanding these facilities and priorities is essential for configuring&nbsp;<code>rsyslog<\/code>&nbsp;effectively.<\/p>\n\n\n\n<ol start=\"3\">\n<li><strong>Basic Logging<\/strong>: By default,&nbsp;<code>rsyslog<\/code>&nbsp;logs messages to the&nbsp;<code>\/var\/log\/syslog<\/code>&nbsp;file. You can view the contents of this file using&nbsp;<code>cat<\/code>&nbsp;or other commands as mentioned earlier.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"advanced-configuration-and-filtering\">Advanced Configuration and Filtering<\/h3>\n\n\n\n<ol>\n<li><strong>Filtering with Templates<\/strong>:<\/li>\n<\/ol>\n\n\n\n<p><code>rsyslog<\/code>&nbsp;allows you to filter and process log messages based on various attributes like facility, severity, or program name. You can create custom templates to format log messages. For instance, to forward specific logs to a remote server:<\/p>\n\n\n\n<ol>\n<li>Create a custom configuration file in&nbsp;<code>\/etc\/rsyslog.d\/<\/code>, like&nbsp;<code>\/etc\/rsyslog.d\/50-remote.conf<\/code>.<\/li>\n\n\n\n<li>Add the following lines to forward messages from the&nbsp;<code>auth<\/code>&nbsp;facility to a remote server with IP&nbsp;<code>1.2.3.4<\/code>:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">if $programname == 'sshd' and $syslogfacility-text == 'auth' then @@1.2.3.4:514<\/code><\/pre>\n\n\n\n<ol start=\"2\">\n<li><strong>Creating Custom Log Files<\/strong>:<\/li>\n<\/ol>\n\n\n\n<p>You can create custom log files for specific applications or services. For example, to create a log file for a service named&nbsp;<code>myapp<\/code>:<\/p>\n\n\n\n<ol>\n<li>Create a custom configuration file in&nbsp;<code>\/etc\/rsyslog.d\/<\/code>, like&nbsp;<code>\/etc\/rsyslog.d\/60-myapp.conf<\/code>.<\/li>\n\n\n\n<li>Add the following lines to create a log file at&nbsp;<code>\/var\/log\/myapp.log<\/code>&nbsp;for messages from the&nbsp;<code>myapp<\/code>&nbsp;program:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">if $programname == 'myapp' then \/var\/log\/myapp.log<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"applying-changes-and-restarting-rsyslog\">Applying Changes and Restarting&nbsp;<code>rsyslog<\/code><\/h3>\n\n\n\n<p>After making changes to&nbsp;<code>rsyslog<\/code>&nbsp;configuration files, you need to restart the&nbsp;<code>rsyslog<\/code>&nbsp;service to apply them:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo service rsyslog restart<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"debugging-and-troubleshooting\">Debugging and Troubleshooting<\/h3>\n\n\n\n<p>If you encounter issues with logging or configuration, you can check the&nbsp;<code>\/var\/log\/syslog<\/code>&nbsp;file for&nbsp;<code>rsyslog<\/code>&nbsp;related messages. Additionally,&nbsp;<code>rsyslog<\/code>&nbsp;itself logs its actions, so you can use the following command to view these logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo journalctl -u rsyslog<\/code><\/pre>\n\n\n\n<p>This will show you&nbsp;<code>rsyslog<\/code>&#8216;s logs, which can be helpful for diagnosing any problems related to the logging service itself.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"conclusion\">Conclusion<\/h2>\n\n\n\n<p>Accessing and configuring system logs is an essential skill for Linux system administrators. Ubuntu and Debian provide a robust set of tools and commands for managing log files, which are crucial for diagnosing issues and monitoring system behavior.<\/p>\n\n\n\n<p>By understanding default log file locations, utilizing log viewing commands like&nbsp;<code>cat<\/code>,&nbsp;<code>tail<\/code>, and&nbsp;<code>head<\/code>, and configuring log rotation with&nbsp;<code>logrotate<\/code>, administrators can effectively manage and maintain log files on their systems. This ensures that important log data is preserved while preventing the accumulation of excessive disk usage.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction System administrators working with Ubuntu and Debian often need to consult log files to troubleshoot issues. This is a fundamental step in diagnosing and resolving problems on these operating systems. Linux-based systems, including Ubuntu and Debian, generate a variety of messages that are recorded in log files. These log messages are crucial for understanding ..<\/p>\n<div class=\"clear-fix\"><\/div>\n<p><a href=\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\" title=\"read more...\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[69],"tags":[],"yoast_head":"\n<title>How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations<\/title>\n<meta name=\"description\" content=\"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"og:description\" content=\"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\" \/>\n<meta property=\"og:site_name\" content=\"WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/webhi.technology\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-28T17:26:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-28T17:26:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en.jpg\" \/>\n<meta name=\"author\" content=\"webhi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:site\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"webhi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\"},\"author\":{\"name\":\"webhi\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\"},\"headline\":\"How to access and configure System Logs on Ubuntu and Debian Systems\",\"datePublished\":\"2023-08-28T17:26:57+00:00\",\"dateModified\":\"2023-08-28T17:26:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\"},\"wordCount\":1276,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"articleSection\":[\"Linux system administration\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\",\"name\":\"How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\"},\"datePublished\":\"2023-08-28T17:26:57+00:00\",\"dateModified\":\"2023-08-28T17:26:59+00:00\",\"description\":\"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.webhi.com\/how-to\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to access and configure System Logs on Ubuntu and Debian Systems\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"name\":\"WebHi Tutorials &amp; Documentations\",\"description\":\"System administration and knowledge base\",\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\",\"name\":\"WebHi Technology\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"width\":288,\"height\":95,\"caption\":\"WebHi Technology\"},\"image\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/webhi.technology\",\"https:\/\/twitter.com\/WebHiTechnology\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\",\"name\":\"webhi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1783029557\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1783029557\",\"caption\":\"webhi\"},\"sameAs\":[\"https:\/\/www.webhi.com\/how-to\"],\"url\":\"https:\/\/www.webhi.com\/how-to\/author\/webhi\/\"}]}<\/script>\n","yoast_head_json":{"title":"How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations","description":"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/","og_locale":"en_US","og_type":"article","og_title":"How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations","og_description":"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.","og_url":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/","og_site_name":"WebHi Tutorials &amp; Documentations","article_publisher":"https:\/\/www.facebook.com\/webhi.technology","article_published_time":"2023-08-28T17:26:57+00:00","article_modified_time":"2023-08-28T17:26:59+00:00","og_image":[{"url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/08\/logs_ubuntu_en.jpg"}],"author":"webhi","twitter_card":"summary_large_image","twitter_creator":"@WebHiTechnology","twitter_site":"@WebHiTechnology","twitter_misc":{"Written by":"webhi","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#article","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/"},"author":{"name":"webhi","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54"},"headline":"How to access and configure System Logs on Ubuntu and Debian Systems","datePublished":"2023-08-28T17:26:57+00:00","dateModified":"2023-08-28T17:26:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/"},"wordCount":1276,"commentCount":0,"publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"articleSection":["Linux system administration"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/","url":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/","name":"How to access and configure System Logs on Ubuntu and Debian Systems - WebHi Tutorials &amp; Documentations","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/#website"},"datePublished":"2023-08-28T17:26:57+00:00","dateModified":"2023-08-28T17:26:59+00:00","description":"A guide to managing system logs on Linux distributions like Ubuntu and Debian. Covers log file locations, viewing logs, logrotate, and the rsyslog daemon.","breadcrumb":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.webhi.com\/how-to\/how-to-access-and-configure-system-logs-on-ubuntu-and-debian-systems\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.webhi.com\/how-to\/"},{"@type":"ListItem","position":2,"name":"How to access and configure System Logs on Ubuntu and Debian Systems"}]},{"@type":"WebSite","@id":"https:\/\/www.webhi.com\/how-to\/#website","url":"https:\/\/www.webhi.com\/how-to\/","name":"WebHi Tutorials &amp; Documentations","description":"System administration and knowledge base","publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.webhi.com\/how-to\/#organization","name":"WebHi Technology","url":"https:\/\/www.webhi.com\/how-to\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/","url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","contentUrl":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","width":288,"height":95,"caption":"WebHi Technology"},"image":{"@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/webhi.technology","https:\/\/twitter.com\/WebHiTechnology"]},{"@type":"Person","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54","name":"webhi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/","url":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1783029557","contentUrl":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1783029557","caption":"webhi"},"sameAs":["https:\/\/www.webhi.com\/how-to"],"url":"https:\/\/www.webhi.com\/how-to\/author\/webhi\/"}]}},"_links":{"self":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/6432"}],"collection":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/comments?post=6432"}],"version-history":[{"count":5,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/6432\/revisions"}],"predecessor-version":[{"id":6449,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/6432\/revisions\/6449"}],"wp:attachment":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/media?parent=6432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/categories?post=6432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/tags?post=6432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}