Quick Reference to Logging Commands
This document is a quick reference for the most common logging commands on Linux. If you know what you're looking for but don't know which command to run, look here. Each command is paired with a short explanation so its purpose is immediately clear.
This document complements the Smart Logging Guide for Rocky Linux. That guide teaches you how to think; this one gives you the exact commands.
Main Log Locations on Linux
Before anything else, know where logs are stored. Most logs live under /var/log/, but some services have their own dedicated paths.
| Path | Description |
|---|---|
/var/log/ | Main directory for all system logs |
/var/log/syslog | General system log (Debian/Ubuntu) |
/var/log/messages | General system log (RHEL/CentOS) |
/var/log/auth.log | Authentication and login log (Debian) |
/var/log/secure | Authentication log (RHEL/CentOS) |
/var/log/kern.log | Kernel-related logs |
/var/log/dmesg | Boot and driver messages |
/var/log/boot.log | System boot process log |
/var/log/cron | Cron job execution log |
/var/log/mail.log | Mail service log |
/var/log/apache2/ | Apache logs (Debian) |
/var/log/httpd/ | Apache logs (RHEL) |
/var/log/nginx/ | Nginx logs |
/var/log/mysql/ | MySQL logs |
/var/log/journal/ | systemd-journald binary logs |
Simple Log Viewing
The cat Command — Show Full File Content
cat displays the entire content of a file at once. It works well for small files but is not recommended for large ones.
cat /var/log/syslog # Show the entire log file
cat -n /var/log/syslog # Show with line numbers
cat file1.log file2.log # Show multiple files back to back
The less Command — Paged Viewing
less opens a file interactively, letting you search and navigate inside it. It's the best choice for large files.
less /var/log/syslog # Interactive viewing
less +F /var/log/syslog # Live view (like tail -f)
less +G /var/log/syslog # Jump to end of file
less -N /var/log/syslog # Show with line numbers
Useful keys in less: /pattern search forward · ?pattern search backward · n next match · N previous match · g start of file · G end of file · q quit.
The more Command — Simple Page-by-Page Viewing
more is the older, simpler cousin of less. It only moves forward and has fewer features.
more /var/log/syslog # Page-by-page view (Space for next page)
Viewing the Start and End of a Log
The head Command — Show First Lines
head shows the first lines of a file. By default, the first 10 lines.
head /var/log/syslog # First 10 lines (default)
head -n 50 /var/log/syslog # First 50 lines
head -c 500 /var/log/syslog # First 500 bytes
The tail Command — Show Last Lines
tail is the most important logging command. It shows the end of a file, and with -f you can follow a log live.
tail /var/log/syslog # Last 10 lines
tail -n 100 /var/log/syslog # Last 100 lines
tail -f /var/log/syslog # Live view (Follow)
tail -F /var/log/syslog # Follow even if file rotates
tail -n +100 /var/log/syslog # From line 100 onward
tail -f /var/log/syslog /var/log/auth.log # Multiple files at once
tail -f --pid=1234 /var/log/app.log # Stop after process exits
The difference between -f and -F: if the file rotates (e.g. syslog moves to syslog.1), -f sticks to the old file while -F follows the new one. For production logs, always use -F.
Searching Logs with grep
grep is like Ctrl+F in a browser, but for files. It's the most common search tool for logs.
Basic Search
grep "error" /var/log/syslog # Simple word search
grep -i "error" /var/log/syslog # Case-insensitive
grep -n "error" /var/log/syslog # Show line numbers
grep -c "error" /var/log/syslog # Count matches
grep -v "info" /var/log/syslog # Lines that do NOT contain info
grep -w "error" /var/log/syslog # Whole-word match
grep -r "error" /var/log/ # Search all files in a directory
grep -l "error" /var/log/*.log # Show only filenames with matches
Advanced Search
grep -A 5 "error" /var/log/syslog # 5 lines after match
grep -B 5 "error" /var/log/syslog # 5 lines before match
grep -C 5 "error" /var/log/syslog # 5 lines before and after
grep -E "error|warning|fail" /var/log/syslog # Multiple words (Regex)
grep -P "\d{3}" /var/log/syslog # Perl Regex
grep "error" /var/log/syslog | grep -v "test" # Chained filters
tail -f /var/log/syslog | grep --line-buffered "error" # Live filter
grep "^Jan" /var/log/syslog # Lines starting with Jan
grep "failed$" /var/log/syslog # Lines ending with failed
The egrep and fgrep Commands
egrep "error|fatal" /var/log/syslog # Same as grep -E
fgrep "192.168.1.1" /var/log/syslog # Fixed-string search (faster)
--line-buffered in tail -f | grep is essential. Without it, grep buffers the output and logs appear delayed.
Working with Systemd Logs (journalctl)
journalctl is the primary tool for viewing systemd logs. On modern distributions (including Rocky Linux, Ubuntu, and Debian), every service managed by systemctl stores its logs in the journal.
Basic Commands
journalctl # Show all systemd logs
journalctl -r # Reverse order (newest first)
journalctl -n 50 # Last 50 logs
journalctl -f # Live view (Follow)
journalctl -e # Jump to the end
journalctl --no-pager # Without paging
journalctl -k # Kernel logs only
journalctl -b # Logs from the current boot
journalctl -b -1 # Logs from the previous boot
journalctl --list-boots # List boots
Filtering by Service and Time
journalctl -u nginx.service # Logs of one specific service
journalctl -u nginx -u php-fpm # Multiple services at once
journalctl -u nginx -f # Live view of a service
journalctl --since "2024-01-01" # From a specific date
journalctl --since "1 hour ago" # Last hour
journalctl --since "yesterday" # Since yesterday
journalctl --since "09:00" --until "10:00" # Time range
journalctl --since today # Today only
journalctl -p err # Errors only
journalctl -p warning..err # Priority range
Priority Levels
| Code | Name | Description |
|---|---|---|
0 | emerg | Emergency — system is unusable |
1 | alert | Action must be taken immediately |
2 | crit | Critical condition |
3 | err | Error |
4 | warning | Warning |
5 | notice | Normal but significant |
6 | info | Informational |
7 | debug | Debug-level messages |
Output Format and Management
journalctl -o json # JSON output
journalctl -o json-pretty # Pretty JSON
journalctl -o short-iso # ISO date
journalctl -o cat # Messages only, no timestamp
journalctl --disk-usage # Journal disk usage
journalctl --verify # Check log integrity
journalctl --vacuum-time=7d # Delete logs older than 7 days
journalctl --vacuum-size=500M # Limit size to 500 MB
journalctl --rotate # Manual log rotation
journalctl _PID=1234 # Logs of a specific PID
journalctl _UID=1000 # Logs of a specific user
journalctl /usr/bin/sshd # Logs of a specific binary
journalctl --vacuum-time and --vacuum-size permanently delete logs. Before running them, make sure you don't need them.
Kernel Logs with dmesg
dmesg displays kernel messages — including boot events, hardware errors, driver issues, and network messages.
dmesg # Show kernel messages
dmesg -T # Show with human-readable time
dmesg -H # Human-readable + colored output
dmesg -w # Live view (Wait/Follow)
dmesg -l err,warn # Filter by level
dmesg --facility=kern # Filter by facility
dmesg | grep -i usb # USB messages only
dmesg | grep -i error # Errors only
dmesg -c # Read and clear the buffer
dmesg --clear # Clear the buffer
User Login Log Commands
These commands show the history of user logins and logouts — either from the wtmp/btmp files or from current system state.
last # Successful user login log
last -n 20 # Last 20 logins
last username # Logins of a specific user
last reboot # Reboot history
last -x shutdown # Shutdown history
lastb # Failed login attempts
lastlog # Last login of every user
lastlog -u root # Last login of a specific user
who # Currently logged-in users
who -a # Full details
w # Logged-in users + activity
users # Simple list of online users
Log Cutting and Processing
The awk Command
awk is a column-processing tool. When logs have a columnar structure (like access.log), awk is the best choice.
awk '{print $1}' /var/log/syslog # First column of each line
awk '{print $1, $2, $3}' /var/log/syslog # Multiple columns
awk '/error/ {print}' /var/log/syslog # Filter error lines
awk 'NR==10' /var/log/syslog # Line 10 only
awk 'NR>=10 && NR<=20' /var/log/syslog # Lines 10 to 20
awk '{count[$5]++} END {for(x in count) print x, count[x]}' access.log # Count by column
The sed and cut Commands
sed -n '10,20p' /var/log/syslog # Show lines 10 to 20
sed -n '/error/p' /var/log/syslog # Show lines containing error
sed '/^$/d' /var/log/syslog # Remove empty lines
sed 's/error/ERROR/g' /var/log/syslog # Replace text
cut -d' ' -f1,2,3 /var/log/syslog # Cut with space delimiter
cut -c1-15 /var/log/syslog # Characters 1 to 15
The sort, uniq, and wc Commands
sort /var/log/syslog # Sort
sort -r /var/log/syslog # Reverse sort
sort -u /var/log/syslog # Remove duplicates
sort file.log | uniq -c # Count duplicate entries
sort file.log | uniq -c | sort -rn # Sort by count
wc -l /var/log/syslog # Count lines
wc -w /var/log/syslog # Count words
wc -c /var/log/syslog # Count bytes
Working with Compressed Logs
Older logs are usually compressed with gzip, bzip2, or xz to save disk space. To read and search them, use the z* version of the same tools.
zcat /var/log/syslog.1.gz # View a gz file
zless /var/log/syslog.1.gz # less for gz
zmore /var/log/syslog.1.gz # more for gz
zgrep "error" /var/log/syslog.*.gz # grep inside gz files
zegrep "error|fail" /var/log/*.gz # egrep inside gz
bzcat file.log.bz2 # View a bz2 file
bzgrep "error" file.log.bz2 # grep inside bz2
xzcat file.log.xz # View an xz file
xzgrep "error" file.log.xz # grep inside xz
For rotated logs (like syslog.1.gz, syslog.2.gz, and so on), you can search all of them at once with the * wildcard: zgrep "error" /var/log/syslog.*.gz. This is extremely useful for tracking down older issues.
Managing Log Rotation with logrotate
logrotate handles rotation, compression, and deletion of old logs. Without it, logs will fill up the disk.
cat /etc/logrotate.conf # Main config file
ls /etc/logrotate.d/ # Per-service configs
logrotate -d /etc/logrotate.conf # Test without running (Debug)
logrotate -f /etc/logrotate.conf # Force rotation
logrotate -v /etc/logrotate.d/nginx # Run with verbose output
cat /var/lib/logrotate/status # Status of last rotations
Sample logrotate Config File
/var/log/myapp/*.log {
daily
rotate 7
compress
delaycompress
missingok
notifempty
create 0640 www-data adm
}
Each line in this config defines one behavior:
| Directive | Meaning |
|---|---|
daily | Rotate daily |
rotate 7 | Keep 7 old versions |
compress | Compress old versions |
delaycompress | Delay compression by one cycle |
missingok | Don't error if the file is missing |
notifempty | Skip rotation if the file is empty |
create 0640 www-data adm | Create new file with specific ownership |
Writing Logs with logger
logger lets you send messages to syslog from inside a script or the command line. It's very useful for tracking custom events.
logger "test message" # Send a message to syslog
logger -p user.info "info message" # With a specific priority
logger -t myapp "app error" # With a tag
logger -f /path/to/file # Send the contents of a file
logger -s "error message" # Send + print to stderr
echo "error" | logger -t backup # Send from a pipe
The tag (-t) lets you easily find your own app's messages later: journalctl -t myapp --since "1 hour ago".
Security and Audit Logs
The auditd and ausearch Commands
The Audit system records every sensitive action on the system — changes to important files, commands run with sudo, login attempts, and SELinux blocks.
systemctl status auditd # Audit service status
ausearch -m USER_LOGIN # Search login events
ausearch -ua username # Events of a specific user
ausearch -f /etc/passwd # Access to a specific file
ausearch -ts today # Today's events
ausearch -k mykey # Search by defined key
aureport # Overall audit report
aureport -au # Authentication report
aureport -l # Login report
aureport -f # File access report
auditctl -l # List active rules
auditctl -w /etc/passwd -p wa -k passwd_changes # Add a rule
Adding the rule auditctl -w /etc/passwd -p wa -k passwd_changes lets you track every write (w) or attribute change (a) on /etc/passwd. This is recommended for sensitive environments.
Web Server Logs
Nginx
tail -f /var/log/nginx/access.log # Live access log
tail -f /var/log/nginx/error.log # Live error log
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head # Top IPs by traffic
grep " 404 " /var/log/nginx/access.log # 404 errors
grep " 500 " /var/log/nginx/access.log # 500 errors
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head # Most-visited URLs
Apache
tail -f /var/log/apache2/access.log # Debian/Ubuntu
tail -f /var/log/httpd/access_log # RHEL/CentOS
tail -f /var/log/apache2/error.log # Apache errors
Apache logs use the _log suffix on RHEL and the .log suffix on Debian. This difference matters in cross-platform scripts.
Live Multi-Log Monitoring
When you need to watch several logs at once, dedicated tools come in handy.
multitail /var/log/syslog # Interactive log viewing
multitail /var/log/syslog /var/log/auth.log # Multiple logs at once
multitail -i /var/log/nginx/access.log -i /var/log/nginx/error.log # In separate windows
lnav /var/log/syslog # Advanced log viewer
lnav /var/log/ # All logs in a directory
lnav has advanced features: SQL-like queries, filters, automatic error highlighting, and time-based navigation. If you frequently investigate logs, it's worth learning.
Network and Firewall Logs
journalctl -u ufw # UFW log
journalctl -u firewalld # firewalld log
grep "UFW BLOCK" /var/log/syslog # UFW blocks
iptables -L -v -n # Show rules + counters
journalctl -u ssh # SSH log
grep "Failed password" /var/log/auth.log # Failed SSH attempts
grep "Accepted" /var/log/auth.log # Successful SSH logins
fail2ban-client status # fail2ban status
fail2ban-client status sshd # SSH jail status
Managing Logging Services
systemctl status rsyslog # rsyslog status
systemctl restart rsyslog # Restart rsyslog
cat /etc/rsyslog.conf # rsyslog config file
ls /etc/rsyslog.d/ # Additional configs
rsyslogd -N1 # Verify config integrity
systemctl status systemd-journald # journald status
systemctl restart systemd-journald # Restart journald
cat /etc/systemd/journald.conf # journald config
Saving and Transferring Log Output
grep "error" /var/log/syslog > errors.txt # Save to file
grep "error" /var/log/syslog >> errors.txt # Append to file
journalctl -u nginx > nginx.log # Journal output to file
journalctl -u nginx --since today | gzip > today.log.gz # Compress on the fly
tail -f /var/log/syslog | tee output.log # Display + save
scp /var/log/syslog user@server:/backup/ # Transfer to a server
tee writes the output both to the screen and to a file simultaneously. It's very useful for live-debugging an issue while saving the log. If you want to append instead of overwrite, use tee -a.
Log Analysis and Statistics
grep -c "error" /var/log/syslog # Number of errors
awk '{print $5}' access.log | sort | uniq -c | sort -rn # Stats of most frequent
grep "Failed password" auth.log | awk '{print $11}' | sort -u # Attacker IPs
grep "Failed password" auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head # Top 10 attacker IPs
awk '$9 == 500' access.log | wc -l # Count of 500 errors
du -sh /var/log/* # Size of each log
find /var/log -type f -size +100M # Logs larger than 100 MB
find /var/log -type f -mtime +30 # Logs older than 30 days
The combination of awk + sort + uniq -c + sort -rn is a golden pattern for any kind of log statistics. If you know the column you're after, these four commands answer almost any question.
Cleanup and Log Volume Management
> /var/log/syslog # Empty the file without deleting it
truncate -s 0 /var/log/syslog # Empty the file (better way)
cat /dev/null > /var/log/syslog # Classic way
find /var/log -name "*.gz" -mtime +30 -delete # Delete old gz files
journalctl --vacuum-time=30d # Delete old journal entries
journalctl --vacuum-size=1G # Limit journal to 1 GB
Never delete a log file with rm. Services that hold the file open keep writing to it, but the disk space is not freed (until the service restarts). Always use truncate or >.
Summary Table of Important Logging Tools
| Tool | Main Purpose |
|---|---|
cat | Show full file content |
less / more | Paged and interactive viewing |
head / tail | Show first / last lines |
tail -f | Live log viewing |
grep | Text search in logs |
awk | Column processing and statistics |
sed | Text replacement and editing |
journalctl | systemd logs |
dmesg | Kernel logs |
last / lastlog / lastb | User login history |
who / w | Currently online users |
logger | Write logs to syslog |
logrotate | Manage log rotation |
zgrep / zcat | Work with compressed logs |
multitail / lnav | Monitor multiple logs at once |
ausearch / aureport | Analyze security audit logs |
fail2ban-client | Manage blocking of malicious IPs |
Summary
- For quick viewing:
catfor small files,lessfor large files,tail -ffor live viewing. - For searching:
grepcombined with-i,-n,-A/-B/-C, and-Ecovers almost every search need. - For systemd logs:
journalctlwith the-u,--since/--until,-p, and-bfilters is the primary tool. - For analysis and statistics: the combination of
awk+sort+uniq -c+sort -rnis a repeatable pattern for any kind of log statistics. - For volume management: configure
logrotateand knowjournalctl --vacuum-*. Never delete a log file withrm.