Linux System Logs

Where are system logs stored in Linux and how do you view them?

Linuxbeginner

// interview question

Where are system logs stored in Linux and how do you view them?

Sample answer

System logs in Linux are typically stored in /var/log. Key log files include: /var/log/syslog or /var/log/messages for general system logs, /var/log/auth.log for authentication events, /var/log/kern.log for kernel messages, and /var/log/dmesg for boot messages. Use commands like tail, cat, less, or journalctl (for systemd) to view logs.

Why this matters

Log analysis is a fundamental skill for troubleshooting issues in production systems. Understanding where logs are stored and how to efficiently search through them helps you quickly diagnose application crashes, security incidents, and system failures.

Code examples

Common log locations and viewing commands

bash

# View last 100 lines of syslog
tail -n 100 /var/log/syslog

# Follow logs in real-time
tail -f /var/log/syslog

# Search for errors in logs
grep -i 'error' /var/log/syslog

# View systemd journal logs
journalctl -u nginx --since '1 hour ago'

# View boot messages
dmesg | tail -50

Log rotation and management

bash

# Check log rotation config
cat /etc/logrotate.conf

# View compressed old logs
zcat /var/log/syslog.1.gz

# Search across multiple log files
grep -r 'connection refused' /var/log/

Common mistakes to avoid

Not checking timestamps when correlating events across services
Forgetting that older logs may be compressed (.gz files)
Not using grep flags like -i for case-insensitive search

Likely follow-ups

What is logrotate and why is it important?
How does journalctl differ from traditional log files?
How would you set up centralized logging for multiple servers?

Answer out loud first, then check yourself against the model answer.

Practice all Junior questions More Linux questions

#linux#logs#troubleshooting#sysadmin#debugging

Also worth your time on this topic

Interview

Linux Process Debugging

A process is consuming 100% CPU on a Linux server. Walk me through how you would identify and troubleshoot this issue.

senior

Exercise

Linux Performance Tuning and Troubleshooting

Master essential Linux performance analysis and optimization techniques to diagnose and resolve system bottlenecks.

80 minutes

Article

How to Fix "Argument List Too Long" Error for rm, cp, and mv Commands

Solve the 'argument list too long' error when working with thousands of files. Learn to use find, xargs, and loops as alternatives to wildcards for bulk file operations.

Linux System Logs

More Linux interview questions

Also worth your time on this topic

Linux Process Debugging

Linux Performance Tuning and Troubleshooting

How to Fix "Argument List Too Long" Error for rm, cp, and mv Commands