System logs (/var/log) in Linux CLI - Step-by-Step Execution

Concept Flow - System logs (/var/log)

System events happen

↓

Logs written to /var/log files

↓

User runs commands to read logs

↓

Commands parse and show log content

↓

User analyzes or filters logs

↓

User takes action based on logs

System events generate messages saved in /var/log files. Users read these logs with commands to understand system behavior.

Execution Sample

Linux CLI

cat /var/log/syslog | grep error

This command shows all lines containing 'error' from the system log file.

Execution Table

Step	Command Part	Action	Result	Output Example
1	cat /var/log/syslog	Reads entire syslog file	Outputs all lines of syslog	Jan 1 12:00:00 hostname systemd[1]: Started Session 1.
2	| grep error	Filters lines containing 'error'	Outputs only lines with 'error'	Jan 1 12:01:00 hostname kernel: [error] device failure detected
3	End	No more lines to read	Command finishes	No more output

💡 All lines read and filtered; command ends when no more lines match.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
syslog_content	empty	full syslog file content	filtered lines with 'error'	filtered lines with 'error'

Key Moments - 2 Insights

Why does the command show only some lines, not the whole file?

Because grep filters lines to only those containing 'error' as shown in execution_table step 2.

What happens if the file /var/log/syslog is very large?

cat reads the whole file, which may take time; using tools like 'tail' can limit output for faster reading.

Visual Quiz - 3 Questions

Look at the execution table, what does step 2 do?

A Reads the entire syslog file

B Ends the command

C Filters lines containing 'error'

D Writes logs to /var/log

💡 Hint

See execution_table row 2 under 'Action' and 'Result'

At which step does the command finish reading the file?

A Step 3

B Step 2

C Step 1

D Never finishes

💡 Hint

Check execution_table row 3 'End' and 'Command finishes'

If you want to see only the last 10 lines of the syslog, which command would you use instead of 'cat'?

A head /var/log/syslog

B tail /var/log/syslog

C grep /var/log/syslog

D less /var/log/syslog

💡 Hint

Think about commands that show the end of a file, see key_moments for large file note

Concept Snapshot

System logs are stored in /var/log.
Use commands like cat, grep, tail to read and filter logs.
Logs help understand system events and errors.
Filtering shows only relevant lines.
Large files can be read efficiently with tail or less.

Full Transcript

System logs are files in the /var/log directory where the system saves messages about its activity. When something happens, like a device error or a service starting, a message is added to these files. To see these messages, you use commands like 'cat' to read the file and 'grep' to filter lines with specific words like 'error'. For example, 'cat /var/log/syslog | grep error' reads the whole syslog file and shows only lines containing 'error'. The execution flow starts with reading the file, then filtering lines, and finally ending when no more lines match. Variables like the content of the syslog file change from empty to full content, then to filtered content. Beginners often wonder why only some lines show up; this is because of filtering with grep. Also, reading large files fully can be slow, so commands like 'tail' help by showing only the last few lines. Understanding these steps helps you check system health and troubleshoot problems by reading logs effectively.