Introduction

Linux system administrators frequently need to check log files for troubleshooting purposes. In fact, this is the first thing any system administrator does.

Linux and the applications running within it have different logging methods. Knowing where these log files are kept and being able to read logs is helpful during problem solving and saves time.

In this article, we will take a look at the Linux logging mechanism.

Warning: The commands used in this article were tested on CentOS 6.4, Ubuntu 12, and Debian 7.

Where Standard Log Files Are Located

Linux log files are located in the “/var/log” directory.

You can simply use the “ls -l /var/log” command to list the log files.

[root@TestLinux ~]# ls -l /var/log

  total 143

  -rw/-. 1 root root  59041 Nov 15 16:04 anaconda.log

  -rw/-. 1 root root 299910 Nov 15 16:04 anaconda.storage.log

  -rw/-. 1 root root  57061 Nov 15 16:04 anaconda.xlog

  -rw*. 2 root root   4096 Nov 15 16:11 audit

  -rw-r–r–  1 root root   2252 Dec  9 10:27 boot.log

  -rw/-. 1 root utmp   1920 Nov 28 09:28 btmp-20131202

  drwxr-xr-x  2 root root   4096 Nov 29 15:47 ConsoleKit

  -rw/-. 1 root root   8809 Dec  2 17:09 cron-20131202

  -rw-r–r–  1 root root  21510 Dec  9 10:27 dmesg

  -rw-r–r–  1 root root  21351 Dec  6 16:37 dmesg.old

  -rw-r–r–. 1 root root 165665 Nov 15 16:04 dracut.log

  -rw-r–r–. 1 root root 146876 Dec  9 10:44 lastlog

  -rw/-. 1 root root   4609 Dec  2 17:00 maillog-20131202

  -rw/-. 1 root root 458481 Dec  2 17:00 messages-20131202

  -rw/-. 1 root root  15984 Dec  2 17:00 secure-20131202

  -rw/-. 1 root root      0 Nov 15 16:02 spooler-20131202

  -rw/-  1 root root   3778 Dec  6 16:48 yum.log

Viewing the Contents of Log Files

Some important log files you can find in “/var/log”:

• wtmp




• utmp




• dmesg




• messages




• maillog or mail.log




• spooler



• auth.log or secure

The contents of some log files like wtmp and utmp cannot be viewed with the “cat” command.

Now let’s use some of these commands.

The “who” command is used to see the people currently connected to the Linux server.

An example on a CentOS server:

[root@TestLinux ~]# who

  root     tty1         2013-12-09 10:44

  root     pts/0        2013-12-09 10:29 (192.168.1.2)

  sysadmin pts/1        2013-12-09 10:31 (192.168.1.2)

  ahmet    pts/2        2013-12-09 10:39 (192.168.1.2)

There is a special situation here. I am the only user of this system, but since it is a server simulated with Oracle VirtualBox, two extra users appear as active in the system. (sysadmin and ahmet)

The following command shows the login dates of users who connected to the server:

[root@TestLinux ~]# last | grep sysadmin

  sysadmin pts/1        192.168.1.2      Mon Dec  9 10:31   ahmet logged in

  sysadmin pts/0        192.168.1.2      Fri Nov 29 15:42 - crash  (00:01)

  sysadmin pts/0        192.168.1.2      Thu Nov 28 17:06 - 17:13  (00:06)

  sysadmin pts/0        192.168.1.2      Thu Nov 28 16:17 - 17:05  (00:48)

  sysadmin pts/0        192.168.1.2      Thu Nov 28 09:29 - crash  (06:04)

  sysadmin pts/0        192.168.1.2      Wed Nov 27 16:37 - down   (00:29)

  sysadmin tty1                          Wed Nov 27 14:05 - down   (00:36)

  sysadmin tty1                          Wed Nov 27 13:49 - 14:04  (00:15)

In this example, I was trying to find the login date for the sysadmin user.

To see when the system was last restarted, you can run the “last reboot” command:

[root@TestLinux ~]# last reboot

  reboot   system boot  2.6.32-358.el6.x Mon Dec  9 10:27 - 10:47  (00:19)

  reboot   system boot  2.6.32-358.el6.x Fri Dec  6 16:37 - 10:47 (2+18:10)

  reboot   system boot  2.6.32-358.el6.x Fri Dec  6 16:28 - 16:36  (00:08)

  reboot   system boot  2.6.32-358.el6.x Fri Dec  6 11:06 - 16:36  (05:29)

  reboot   system boot  2.6.32-358.el6.x Mon Dec  2 17:00 - 16:36 (3+23:36)

  reboot   system boot  2.6.32-358.el6.x Fri Nov 29 16:01 - 16:36 (7+00:34)

  reboot   system boot  2.6.32-358.el6.x Fri Nov 29 15:43 - 16:36 (7+00:53)

  …

  …

  wtmp begins Fri Nov 15 16:11:54 2013

Use the “lastlog” command to see the last person to log into the system:

[root@TestLinux ~]# lastlog

  Username        Port        From            Latest

  root            tty1                        Mon Dec  9 10:44:30 +1100 2013

  bin                                        Never logged in

  daemon                                     Never logged in

  adm                                        Never logged in

  lp                                         Never logged in

  sync                                       Never logged in

  shutdown                                   Never logged in

  halt                                       Never logged in

  mail                                       Never logged in

  uucp                                       Never logged in

  operator                                   Never logged in

  games                                      Never logged in

  gopher                                     Never logged in

  ftp                                        Never logged in

  nobody                                     Never logged in

  vcsa                                       Never logged in

  saslauth                                   Never logged in

  postfix                                    Never logged in

  sshd                                       Never logged in

  sysadmin         pts/1    192.168.1.2      Mon Dec  9 10:31:50 +1100 2013

  dbus                                       Never logged in

  ahmet            pts/2    192.168.1.2      Mon Dec  9 10:39:24 +1100 2013

For other text-based log files, you can read them using the “cat”, “head”, or “tail” commands.

In the following example, I am trying to view the last lines of the /var/log/messages log file on a Debian server:

debian@debian:~$ sudo tail /var/log/messages

  Dec 16 01:21:08 debian kernel: [    9.584074] Bluetooth: BNEP (Ethernet Emulation) ver 1.3

  Dec 16 01:21:08 debian kernel: [    9.584074] Bluetooth: BNEP filters: protocol multicast

  Dec 16 01:21:08 debian kernel: [    9.648220] Bridge firewalling registered

  Dec 16 01:21:08 debian kernel: [    9.696728] Bluetooth: SCO (Voice Link) ver 0.6

  Dec 16 01:21:08 debian kernel: [    9.696728] Bluetooth: SCO socket layer initialized

  Dec 16 01:21:08 debian kernel: [    9.832215] lp: driver loaded but no devices found

  Dec 16 01:21:08 debian kernel: [    9.868897] ppdev: user-space parallel port driver

  Dec 16 01:21:11 debian kernel: [   12.748833] [drm] Initialized drm 1.1.0 20060810

  Dec 16 01:21:11 debian kernel: [   12.754412] pci 0000:00:02.0: PCI INT A -> Link[LNKB] -> GSI 11 (level, low) -> IRQ 11

  Dec 16 01:21:11 debian kernel: [   12.754412] [drm] Initialized vboxvideo 1.0.0 20090303 for 0000:00:02.0 on minor 0

Here I used the “tail” command to view the log content. Below I will write the commands with which logs can be viewed:

• cat: Prints the entire file to the screen




• head: Prints the top 10 lines of the file to the screen




• tail: Prints the last 10 lines of the file to the screen




• nano: Nano is actually a file editor. It opens the file allowing you to edit and navigate within it. With this command you can open the file and navigate through it to conveniently view the logs.



• vi: A file editor similar to nano

rsyslog Service

Behind the daily logging mechanism is the rsyslog service. This service is used to listen to messages coming from different parts of a Linux system and to save them appropriately in the /var/log directory.

Rsyslog Configuration File

The rsyslog service is configured from the rsyslog.conf file. This file is located in the /etc directory.

Basically, the rsyslog.conf file instructs the rsyslog service how to record log messages. This instruction in the file comes in the form of a series of two-part lines.

This file is found on Ubuntu as “rsyslog.d/50-default.conf”.

An example of rsyslog.conf content on a CentOS system:

# rsyslog v5 configuration file

  …

  …

  # Include all config files in /etc/rsyslog.d/

  IncludeConfig /etc/rsyslog.d*/-  1 root root      0 Dec  9 11:21 local4crit.log

  -rw/-  1 root root    359 Dec 17 18:25 maillog

  -rw/-  1 root root  30554 Dec 17 18:25 messages

  -rw/-  1 root root    591 Dec 17 18:28 secure

  -rw/-  1 root root    0 Dec 17 18:34 /var/log/maillog

  -rw**/-  1 root root  359 Dec 17 18:25 /var/log/maillog-20131217


[root@TestLinux ~]# ls -l /var/log/messages*

  -rw/-. 1 root root 180429 Dec 16 16:35 /var/log/messages-20131216

  -rw/-  1 root root    0 Dec 17 18:34 /var/log/secure

  -rw**/-  1 root root  591 Dec 17 18:28 /var/log/secure-20131217

  [root@TestLinux ~]#

As you can see, the logs have been archived by date and the files containing the latest logs have been cleared.

We hope this article has given you some ideas about the Linux log system. Log files in the Linux operating system are life-savers. They save you time and give you information about the status of the system. Log files should be the first thing you consult when
facing a problem you cannot solve…

Abdullah Altunbaş

Content Writer

Netinternet Bilişim Teknolojileri A.Ş.'de teknik konularda liderlik yapıyorum. 15 yıldır bu alanda çalışıyorum ve özellikle sistem yönetimi, ağ teknolojileri ve yazılım geliştirme konularına odaklanıyorum.