System logs (/var/log) in Linux CLI - Step-by-Step Execution

Concept Flow - System logs (/var/log)

System events happen

↓

Logs written to /var/log files

↓

User runs commands to read logs

↓

Commands parse and show log content

↓

User analyzes or filters logs

↓

User takes action based on logs

System events generate messages saved in /var/log files. Users read these logs with commands to understand system behavior.

Execution Sample

Linux CLI

cat /var/log/syslog | grep error

This command shows all lines containing 'error' from the system log file.

Execution Table

Step	Command Part	Action	Result	Output Example
1	cat /var/log/syslog	Reads entire syslog file	Outputs all lines of syslog	Jan 1 12:00:00 hostname systemd[1]: Started Session 1.
2	| grep error	Filters lines containing 'error'	Outputs only lines with 'error'	Jan 1 12:01:00 hostname kernel: [error] device failure detected
3	End	No more lines to read	Command finishes	No more output

💡 All lines read and filtered; command ends when no more lines match.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
syslog_content	empty	full syslog file content	filtered lines with 'error'	filtered lines with 'error'

Key Moments - 2 Insights

Why does the command show only some lines, not the whole file?

Because grep filters lines to only those containing 'error' as shown in execution_table step 2.

What happens if the file /var/log/syslog is very large?

cat reads the whole file, which may take time; using tools like 'tail' can limit output for faster reading.

Visual Quiz - 3 Questions

Look at the execution table, what does step 2 do?

A Reads the entire syslog file

B Ends the command

C Filters lines containing 'error'

D Writes logs to /var/log

💡 Hint

See execution_table row 2 under 'Action' and 'Result'

At which step does the command finish reading the file?

A Step 3

B Step 2

C Step 1

D Never finishes

💡 Hint

Check execution_table row 3 'End' and 'Command finishes'

If you want to see only the last 10 lines of the syslog, which command would you use instead of 'cat'?

A head /var/log/syslog

B tail /var/log/syslog

C grep /var/log/syslog

D less /var/log/syslog

💡 Hint

Think about commands that show the end of a file, see key_moments for large file note

Concept Snapshot

System logs are stored in /var/log.
Use commands like cat, grep, tail to read and filter logs.
Logs help understand system events and errors.
Filtering shows only relevant lines.
Large files can be read efficiently with tail or less.

Full Transcript

System logs are files in the /var/log directory where the system saves messages about its activity. When something happens, like a device error or a service starting, a message is added to these files. To see these messages, you use commands like 'cat' to read the file and 'grep' to filter lines with specific words like 'error'. For example, 'cat /var/log/syslog | grep error' reads the whole syslog file and shows only lines containing 'error'. The execution flow starts with reading the file, then filtering lines, and finally ending when no more lines match. Variables like the content of the syslog file change from empty to full content, then to filtered content. Beginners often wonder why only some lines show up; this is because of filtering with grep. Also, reading large files fully can be slow, so commands like 'tail' help by showing only the last few lines. Understanding these steps helps you check system health and troubleshoot problems by reading logs effectively.

Practice

1. What is the primary purpose of files located in the /var/log/ directory on a Linux system?

easy

A. To hold user personal documents and files

B. To contain system configuration files

C. To save temporary files created during program execution

D. To store system and application logs recording events and errors

Solution

1. Step 1: Understand the role of /var/log/

   The /var/log/ directory is designed to keep logs about system and application activities.

2. Step 2: Differentiate from other directories

   Other directories like /home store user files, /etc holds configs, and /tmp stores temporary files.

3. Final Answer:

   To store system and application logs recording events and errors -> Option D

4. Quick Check:

   /var/log/ = system logs [OK]

Hint: Remember: /var/log holds logs, not configs or user files [OK]

Common Mistakes:

• Confusing /var/log with /etc for configs
• Thinking /var/log stores user documents
• Mixing up temporary files with logs

2. Which command correctly displays the last 10 lines of the /var/log/syslog file?

easy

A. tail /var/log/syslog

B. head /var/log/syslog

C. cat /var/log/syslog | head

D. less /var/log/syslog

Solution

1. Step 1: Recall command functions

   The tail command shows the last lines of a file; by default, it shows the last 10 lines.

2. Step 2: Compare options

   head shows the first lines, cat | head also shows first lines, and less opens a pager for browsing but does not directly show last lines.

3. Final Answer:

   tail /var/log/syslog -> Option A

4. Quick Check:

   tail = last 10 lines [OK]

Hint: Use tail to see last lines quickly [OK]

Common Mistakes:

• Using head instead of tail for last lines
• Confusing less with tail output
• Piping cat to head for last lines

3. What will be the output of the command grep 'error' /var/log/syslog | wc -l?

medium

A. It displays all lines from /var/log/syslog except those with 'error'

B. It shows the number of lines containing the word 'error' in /var/log/syslog

C. It counts all words in /var/log/syslog

D. It shows the first line containing 'error' in /var/log/syslog

Solution

1. Step 1: Understand grep and wc -l

   grep 'error' /var/log/syslog filters lines containing 'error'. wc -l counts the number of lines from that output.

2. Step 2: Combine command effects

   The pipeline counts how many lines in syslog have the word 'error'.

3. Final Answer:

   It shows the number of lines containing the word 'error' in /var/log/syslog -> Option B

4. Quick Check:

   grep + wc -l = count matching lines [OK]

Hint: grep filters lines; wc -l counts them [OK]

Common Mistakes:

• Thinking grep excludes matching lines
• Confusing wc -l with word count
• Assuming output shows lines, not count

4. You run tail -n 20 /var/log/auth.log but get an error: "tail: cannot open '/var/log/auth.log' for reading: Permission denied". What is the best way to fix this?

medium

A. Run the command with sudo: sudo tail -n 20 /var/log/auth.log

B. Change the file permissions with chmod 777 /var/log/auth.log

C. Copy the file to your home directory and run tail there

D. Use head instead of tail

Solution

1. Step 1: Identify permission issue

   The error says permission denied, meaning the user lacks rights to read the file.

2. Step 2: Use elevated privileges safely

   Using sudo runs the command as root, allowing access without changing file permissions.

3. Final Answer:

   Run the command with sudo: sudo tail -n 20 /var/log/auth.log -> Option A

4. Quick Check:

   Permission denied? Use sudo [OK]

Hint: Use sudo for restricted log files [OK]

Common Mistakes:

• Changing permissions insecurely with chmod 777
• Copying files without permissions
• Using head instead of fixing permissions

5. You want to monitor new entries added to /var/log/syslog in real-time and filter only lines containing the word 'failed'. Which command achieves this?

hard

A. cat /var/log/syslog | tail -f

B. grep failed /var/log/syslog

C. tail -f /var/log/syslog | grep failed

D. less /var/log/syslog | grep failed

Solution

1. Step 1: Understand real-time monitoring

   tail -f shows new lines added to a file live as they appear.

2. Step 2: Filter output for 'failed'

   Piping tail -f output to grep failed shows only lines containing 'failed' in real-time.

3. Final Answer:

   tail -f /var/log/syslog | grep failed -> Option C

4. Quick Check:

   tail -f + grep = live filtered log [OK]

Hint: Use tail -f piped to grep for live filtered logs [OK]

Common Mistakes:

• Using grep alone shows only current matches, no live updates
• Using cat with tail -f incorrectly
• Trying to grep inside less which is not live