iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
On current Ubuntu, Debian, and CentOS/RHEL-family systems, start with journalctl: systemd-journald records structured events from the kernel, services, and applications. Traditional text files under /var/log still matter when rsyslog is installed and routing messages there, or when an application writes its own files. The two systems can coexist, so a missing /var/log/syslog does not necessarily mean that logging is broken.
The practical question is usually not simply “Where are Linux logs?” but “Which logger received this event, where was it routed, and was that storage retained?” The answer varies with distribution, release, installed packages, and local policy. The commands below let you identify the active source before changing configuration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How Linux logging is divided
systemd-journald receives kernel messages, early-boot output, daemon standard output and error, messages sent through libc’s syslog interface, native Journal API records, and (where configured) audit records. You query it with journalctl. Journal data is binary and is kept either persistently below /var/log/journal or temporarily below /run/log/journal.
rsyslog is a separate service that can receive messages from journald and other inputs, apply facility and priority rules, and write ordinary text files in /var/log. Ubuntu and Debian commonly route to files such as /var/log/syslog; CentOS/RHEL commonly uses /var/log/messages. An application can bypass both and write its own directory, such as Apache’s /var/log/apache2/access.log and error.log on Ubuntu.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Defaults differ by release and installation profile. Verify the unit names, installed packages, active journald settings, and rsyslog rules on the exact host you are administering. A minimal cloud image may have journald only, while a full installation may have both services and several text destinations.
Command-first quick reference
| Need | Command | What to expect |
|---|---|---|
| Show all journal entries | sudo journalctl |
Entries are displayed in chronological order with timestamps, boot information, units, and message text. |
| Show the current boot | sudo journalctl -b |
Restricts output to the boot that is currently running. |
| List recorded boots | sudo journalctl --list-boots |
Shows boot indexes, IDs, and the first and last timestamps retained. |
| Show the previous boot | sudo journalctl -b -1 |
Uses the boot immediately before the current one, if it was retained. |
| Show a particular boot | sudo journalctl -b BOOT_ID |
Replace BOOT_ID with an ID from --list-boots. |
| Show one service | sudo journalctl -u ssh.service |
Replace ssh.service with the actual systemd unit. |
| Follow a service live | sudo journalctl -u ssh.service -f |
Waits for and prints new records as the service runs. |
| Show kernel messages | sudo journalctl -k |
Filters the journal to kernel records. Debian also documents sudo journalctl -b --system for system and kernel logs. |
| Read a text log | sudo less /var/log/syslogsudo less /var/log/messages |
Use the file that exists on the distribution and host. |
| Print the newest 100 lines | sudo tail -n 100 /var/log/syslog |
Useful for a quick snapshot without opening a pager. |
| Follow a text file | sudo tail -f /var/log/syslog |
Displays lines appended after the command starts. |
| Search a text file | sudo grep -i 'error|fail|warning' /var/log/syslog |
Case-insensitively searches for any of the three terms. |
Press q to leave less or a normal journalctl pager. Add sudo when your account cannot read the journal or the file directly. For an incident, record the command, boot selection, and time window used so another administrator can reproduce the view.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ubuntu, Debian and CentOS/RHEL: what differs
| Area | Ubuntu | Debian | CentOS/RHEL family |
|---|---|---|---|
| Primary query interface | journalctl against systemd-journald on modern installations. |
||
| Common traditional files | /var/log/auth.log for authorization activity, /var/log/kern.log for kernel messages, and /var/log/syslog for general system information. |
File names depend on the installed and configured rsyslog rules; journal queries are the portable starting point. | /var/log/messages, /var/log/secure, /var/log/maillog, /var/log/cron, and /var/log/boot.log are the conventional names described for RHEL 8. |
| rsyslog | May be installed and route journal/syslog messages to text files; it is not guaranteed on every image. | May be installed and route messages according to local rules. | RHEL documentation describes journald forwarding to rsyslog, which sorts and writes messages under /var/log; confirm the package and policy on your release. |
| Journal persistence | Controlled by journald storage settings and the presence of /var/log/journal; /run/log/journal is volatile. |
||
| Package manager | apt |
apt |
dnf on current CentOS/RHEL-family systems. |
| Typical service units | Use the unit installed on the host (for example, ssh.service); names can differ between distributions and packages. |
||
| Access | Journal and security files are protected by systemd-journal and file permissions. Privileged access may be required; membership in the system journal group can grant journal-read access. | ||
The table describes common layouts, not guarantees. A Debian administrator who expects auth.log, or a CentOS administrator who expects messages, should first confirm that rsyslog is installed and that a rule actually writes that destination. The journal remains the least distribution-specific starting point.
View journal entries by boot, service and source
Inspect the current startup
Run sudo journalctl -b to see messages from the running boot only. This is the most useful first query after a startup failure because older boots cannot obscure the sequence you are investigating. For a system-wide view that includes system and kernel records on Debian, use sudo journalctl -b --system.
Compare with an earlier boot
First run sudo journalctl --list-boots. The output supplies a relative index and a boot ID for every retained boot. Then use sudo journalctl -b -1 for the immediately preceding boot, or provide a specific ID with sudo journalctl -b BOOT_ID. If only the current boot appears, earlier data was not retained, was rotated away, or the journal was volatile. A boot ID is safer than assuming that a particular index still refers to the same startup after rotation.
Trace one service
Use the exact systemd unit, not merely the display name: sudo journalctl -u ssh.service. To watch a restart or connection attempt as it happens, add -f: sudo journalctl -u ssh.service -f. If that returns no records, check the unit name with your service-management tools and verify that the program actually runs under systemd; a manually launched process may log elsewhere.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Limit the view to kernel records
sudo journalctl -k selects kernel messages. This is appropriate for driver, storage, networking, and hardware investigations. It does not replace a service query: daemon failures generally appear under their own unit and may also be forwarded to rsyslog.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Find and read traditional files under /var/log
Ubuntu files
/var/log/auth.logrecords authorization activity such as password prompts,sudouse, and remote logins./var/log/kern.logcontains kernel messages when the configured logger writes that file./var/log/syslogis the usual general-purpose system log when rsyslog routing provides it.
Ubuntu’s GNOME Logs application can display, monitor, search, open, and close log files through a graphical interface. It is a viewer, not a substitute for configuring journald or rsyslog. If the application shows fewer entries than a privileged command, file permissions or the selected source may explain the difference.
Debian files
Debian installations vary more with the selected packages and local rules. Begin with journalctl; then inspect whichever files exist under /var/log, especially after confirming that rsyslog is installed and enabled. Do not assume that an Ubuntu file name is present on every Debian installation. Debian’s documented examples include journalctl -b --system, journalctl -b -u UNIT, and the follow form for live service output.
CentOS/RHEL files
/var/log/messagesis the conventional general system log./var/log/securecontains security and authentication events./var/log/maillogcontains mail-system events when mail logging is configured./var/log/croncontains cron activity./var/log/boot.logcontains boot-script output where that logger is used.
These names come from RHEL 8 documentation; a later release, minimal image, container, or hardened policy can route differently. RHEL describes journald as collecting kernel, early-boot, daemon standard output and error, and syslog messages before forwarding to rsyslog, which sorts and writes files under /var/log.
Recommended Free Tools
Application-specific logs
Services do not have to use the system logger. For example, Apache on Ubuntu commonly writes /var/log/apache2/access.log and /var/log/apache2/error.log. Check the application’s own configuration and documentation when neither journalctl -u nor the expected system file contains the event. This distinction is especially important for web servers: an HTTP request may be present in Apache’s access log while startup diagnostics appear in the service journal.
Make journald logs survive a reboot
Journald stores records persistently below /var/log/journal or volatilely below /run/log/journal. The latter is normally cleared during reboot. The Storage= setting in /etc/systemd/journald.conf controls the policy; do not promise a retention period without checking the active size and time limits. Persistence also requires enough disk space and permissions for journald to create and maintain its files.
Initialize persistent storage with the default policy
- Create the directory:
sudo mkdir -p /var/log/journal - Apply systemd’s ownership and mode rules:
sudo systemd-tmpfiles --create --prefix=/var/log/journal - Move runtime data into persistent storage:
sudo journalctl --flush - Confirm that data is being accounted for:
journalctl --disk-usage - Run a test query, such as
sudo journalctl -b, and reboot only after confirming that the journal is readable.
If you explicitly edit /etc/systemd/journald.conf, set the desired Storage= value, save the file, and apply it with sudo systemctl restart systemd-journald (or the reload procedure documented for your release). Review SystemMaxUse=, RuntimeMaxUse=, MaxRetentionSec=, and related limits before relying on a retention duration; defaults are release-specific. A persistent directory therefore improves reboot history but does not guarantee unlimited history.
Install and configure rsyslog routing
Use rsyslog only when you need traditional files, forwarding, or facility/priority routing. Keep distribution defaults intact and put local rules in /etc/rsyslog.d/*.conf rather than casually replacing /etc/rsyslog.conf. A route can be syntactically valid yet still produce no file if its selectors do not match the message or the destination cannot be opened.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Install and enable the service
- On Ubuntu or Debian, install it with
sudo apt update && sudo apt install rsyslog - On CentOS/RHEL-family systems, use
sudo dnf install rsyslog - Enable it now and at future boots:
sudo systemctl enable --now rsyslog
Add a local rule
A minimal modern configuration that loads the local socket and kernel inputs and writes to a general text log is:
module(load="imuxsock")
module(load="imklog")
action(type="omfile" file="/var/log/syslog")Save a local rule in a file such as /etc/rsyslog.d/10-local.conf. On a CentOS/RHEL host, choose the file name your policy expects, such as /var/log/messages, and preserve the distribution’s existing selectors and templates instead of blindly adding a competing catch-all action. Ensure the parent directory and file permissions allow the rsyslog process to write while preventing ordinary users from altering records.
Validate before restarting
- Check syntax without disrupting the running daemon:
sudo rsyslogd -N1 - Only after a successful check, restart:
sudo systemctl restart rsyslog - Generate a known test message:
logger -t logtest "hello" - Inspect the configured destination with
sudo lessorsudo tail -n 100. If no line appears, check the rsyslog service status, file permissions, selectors, and whether journald forwarding is enabled.
Custom destinations must be writable by the rsyslog process and protected from untrusted users. A syntax error, an invalid module, or a path that cannot be opened can prevent the service from restarting, which is why rsyslogd -N1 belongs in the change procedure. Keep a copy of the last known-good snippet so a failed edit can be reverted without discarding the distribution’s main configuration.
Rotation, retention and access controls
Traditional text files are normally rotated by the distribution’s logrotate policy. Inspect /etc/logrotate.conf and /etc/logrotate.d/ on the target host to learn the actual schedule, compression, and retention; those values were not uniform across Ubuntu, Debian, and CentOS/RHEL releases. A rotated file may therefore have a suffix or compression format, so searching only the current filename can miss an older event.
Journal files use journald’s own rotation and size controls. Review the active journald configuration, including SystemMaxUse=, RuntimeMaxUse=, and MaxRetentionSec=, before estimating how far back queries can go. Disk usage reported by journalctl --disk-usage is a useful capacity check, not a promise of a fixed number of days.
Authentication, authorization, and audit records are sensitive. Restrict permissions, grant journal-group access only to appropriate operators, and redact credentials, tokens, personal data, and host-identifying details before sharing excerpts in tickets or forums. Do not make a security log world-readable merely to simplify troubleshooting.
Troubleshoot missing or unexpected logs
/var/log/syslog or /var/log/messages is absent or empty
- Query
sudo journalctl -bfirst. The host may be using journald without rsyslog text output. - Check whether rsyslog is installed and running with the service manager.
- Inspect
/etc/rsyslog.confand/etc/rsyslog.d/for a rule that routes to a different path. - Run
sudo rsyslogd -N1before changing anything; then uselogger -t logtest "hello"to test the route.
An empty text file can also mean that the event was generated before rsyslog started, that the application writes a private file, or that selectors exclude the facility or priority. Compare a live journal query with the text destination to determine where the message disappears.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Earlier boots do not appear
sudo journalctl --list-boots shows what is retained. If there is no previous boot, the journal was probably volatile under /run/log/journal, was rotated under its configured limits, or was removed. Create and initialize /var/log/journal, flush the journal, and verify disk usage before the next reboot.
Free tools Windows power users keep installed
One-click scans. No signup required.
A service query returns nothing
- Confirm the exact unit name; package names and unit names are not always identical.
- Try
sudo journalctl -b -u UNIT.serviceto constrain both the unit and boot. - Determine whether the program was started manually, inside a container, or by another supervisor; its output may be in an application-specific file or a different logging system.
Permission denied
Retry with sudo. If operators need routine read access, use the distribution’s system-journal group policy rather than making log files world-readable. File permissions on security logs and custom rsyslog destinations are independent of journal membership.
Rsyslog will not restart after an edit
Run sudo rsyslogd -N1 and correct the reported line, module, selector, or destination. Keep local changes in /etc/rsyslog.d/*.conf, restore the last known-good file if necessary, validate again, and then restart. Check the service’s own journal for startup errors.
The journal is binary and difficult to copy
Use journalctl to select the relevant boot or unit and redirect the resulting text to a protected file only after removing secrets. Do not edit journal files directly; retention, rotation, and integrity depend on journald’s management.
A safe diagnostic sequence
- Identify the time window and whether the problem spans a reboot.
- Run
sudo journalctl -b; use--list-bootsand-b -1if the event occurred before the current boot. - Filter to the suspected unit with
sudo journalctl -u UNIT.service, or to the kernel withsudo journalctl -k. - Check the distribution’s expected file under
/var/logwithless,tail, orgrep. - If the file is missing, inspect rsyslog installation, configuration, syntax, permissions, and service status.
- For reboot-related investigations, make journald persistent and verify
journalctl --disk-usagebefore collecting more evidence.
Commands and defaults should always be tested against the exact Ubuntu, Debian, or CentOS/RHEL release, because package selection, routing rules, retention limits, and unit names are distribution- and release-dependent.
Frequently Asked Questions
Where are Linux logs stored on Ubuntu?
Start with sudo journalctl. When rsyslog text routing is enabled, Ubuntu commonly has /var/log/auth.log for authorization events, /var/log/kern.log for kernel messages, and /var/log/syslog for general system information. Applications can use separate paths, such as Apache’s /var/log/apache2/ files.
Where are Linux logs stored on CentOS or RHEL?
Use sudo journalctl first. Conventional RHEL locations include /var/log/messages, /var/log/secure, /var/log/maillog, /var/log/cron, and /var/log/boot.log when rsyslog and the relevant routing rules are present.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
How do I view logs from the previous boot?
Run sudo journalctl --list-boots, then sudo journalctl -b -1 or query a specific boot ID. No previous entry usually means the journal was volatile, rotated away, or removed.
Why is /var/log/syslog or /var/log/messages empty?
The host may be using journald without rsyslog text output, routing to another file, filtering the message with selectors, or letting the application write its own log. Check sudo journalctl -b, inspect /etc/rsyslog.conf and /etc/rsyslog.d/, validate with sudo rsyslogd -N1, and send logger -t logtest "hello" as a controlled test.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How do I make journald logs persist after reboot?
Create /var/log/journal, apply its permissions with sudo systemd-tmpfiles --create --prefix=/var/log/journal, and run sudo journalctl --flush. Check journalctl --disk-usage and the active Storage= and size limits in /etc/systemd/journald.conf.
Do I need rsyslog if journald already works?
Not necessarily. Journald is the primary structured logger on modern systems. Install or retain rsyslog when you need traditional text files, facility and priority routing, or forwarding, and verify its rules before relying on a destination.
How can I follow a service log in real time?
Use the exact unit name with sudo journalctl -u UNIT.service -f. For a text destination, use sudo tail -f /var/log/syslog or the applicable file. A manually launched process may not write to either location.
Can ordinary users read all Linux logs?
Often not. Journal access and file permissions protect logs, especially authentication and audit records. Use sudo or the host’s system-journal group policy for approved operators, and never make sensitive files world-readable.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow should I configure rsyslog safely?
Put local rules in /etc/rsyslog.d/*.conf, preserve the distribution’s main configuration, run sudo rsyslogd -N1, restart only after a successful check, then send a logger test message and inspect the destination.
The Bottom Line
Use journalctl as the portable starting point, selecting the current or previous boot, a precise service unit, or kernel records as needed. Treat /var/log files as optional rsyslog or application outputs whose names differ between Ubuntu, Debian, and CentOS/RHEL. If reboot history matters, create and initialize /var/log/journal; if text routing matters, add a validated rule under /etc/rsyslog.d/. Check permissions, rotation, and release-specific limits before drawing conclusions from missing or short log history.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
