System logs (/var/log) in Linux CLI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the /var/log directory in Linux?

The /var/log directory stores system log files. These logs record events, errors, and messages from the system and applications to help monitor and troubleshoot.

beginner

Which command shows the last 10 lines of a log file?

The tail command shows the last 10 lines by default. For example, tail /var/log/syslog shows the last 10 lines of the syslog file.

beginner

How can you continuously watch new entries added to a log file?

Use tail -f /var/log/filename. This command shows new lines as they are added, like watching a live feed.

intermediate

What is the difference between /var/log/syslog and /var/log/auth.log?

/var/log/syslog records general system messages and events. /var/log/auth.log records authentication-related events like logins and sudo usage.

beginner

Why is it important to check system logs regularly?

Checking logs helps find problems early, understand system behavior, and improve security by spotting unauthorized access or errors.

Which command shows the last 20 lines of /var/log/syslog?

A tail -n 20 /var/log/syslog

B head -n 20 /var/log/syslog

C cat /var/log/syslog | less

D grep 20 /var/log/syslog

tail -n 20 shows the last 20 lines of the file. head shows the first lines, cat | less shows the whole file page by page, and grep 20 searches for the text '20'.

What does the command tail -f /var/log/auth.log do?

A Shows the last lines and updates live as new lines are added

B Deletes the auth.log file

C Shows the first lines of auth.log

D Searches for the word 'auth' in the log

tail -f shows the end of the file and keeps showing new lines as they appear, useful for live monitoring.

Which log file would you check to find failed login attempts?

A /var/log/syslog

B /var/log/kern.log

C /var/log/dmesg

D /var/log/auth.log

/var/log/auth.log records authentication events including failed logins.

What is the main reason to use system logs?

A To store user files

B To monitor system events and troubleshoot problems

C To install software

D To speed up the system

System logs help track what happens on the system and find issues.

Which command would you use to search for the word 'error' in /var/log/syslog?

A cat error /var/log/syslog

B tail error /var/log/syslog

C grep error /var/log/syslog

D head error /var/log/syslog

grep searches for text patterns in files. Here it finds lines containing 'error'.

Explain how you would monitor a system log file in real time to catch new events as they happen.

Think about a command that shows the end of a file and keeps updating.

Describe the difference between /var/log/syslog and /var/log/auth.log and when you would check each.

One is for overall system events, the other for security-related events.