System logs (/var/log) in Linux CLI - Commands & Configuration

Introduction

System logs keep track of what happens on your computer. They help you find problems or see what programs are doing by saving messages in files inside the /var/log folder.

When you want to check why your computer or a program stopped working.

When you want to see who logged into your system and when.

When you want to monitor if your system is running smoothly without errors.

When you want to find out if a service like the web server started correctly.

When you want to keep a record of system events for security or troubleshooting.

Commands

This command lists all the log files and folders inside /var/log so you can see what logs are available.

Terminal

ls /var/log

Expected Output

alternatives.log

apt

auth.log

boot.log

dpkg.log

kern.log

syslog

wtmp

This shows the last 10 lines of the main system log file to quickly see recent system messages.

Terminal

cat /var/log/syslog | tail -n 10

Expected Output

Jun 10 10:00:01 my-computer CRON[1234]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 10:00:02 my-computer systemd[1]: Started Daily apt download activities.

Jun 10 10:00:02 my-computer systemd[1]: Started Daily apt upgrade and clean activities.

Jun 10 10:05:01 my-computer CRON[1235]: (root) CMD (run-parts /etc/cron.daily)

Jun 10 10:10:01 my-computer CRON[1236]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 10:15:01 my-computer CRON[1237]: (root) CMD (run-parts /etc/cron.daily)

Jun 10 10:20:01 my-computer CRON[1238]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 10:25:01 my-computer CRON[1239]: (root) CMD (run-parts /etc/cron.daily)

Jun 10 10:30:01 my-computer CRON[1240]: (root) CMD (run-parts /etc/cron.hourly)

Jun 10 10:35:01 my-computer CRON[1241]: (root) CMD (run-parts /etc/cron.daily)

→

-n 10 - Shows only the last 10 lines of the file

This command searches the system log for the word 'error' to find any error messages quickly.

Terminal

grep 'error' /var/log/syslog

Expected Output

Jun 10 09:45:12 my-computer kernel: [12345.678901] error: failed to start service

Jun 10 09:50:33 my-computer systemd[1]: error: service crashed unexpectedly

This command shows new authentication log entries live as they happen, useful to watch login attempts in real time.

Terminal

tail -f /var/log/auth.log

Expected Output

Jun 10 10:40:01 my-computer sshd[1300]: Accepted password for user from 192.168.1.10 port 54321 ssh2

Jun 10 10:41:05 my-computer sshd[1301]: Failed password for invalid user admin from 192.168.1.11 port 54322 ssh2

→

-f - Keeps the command running and shows new lines as they are added

Key Concept

If you remember nothing else from this pattern, remember: system logs in /var/log hold important messages that help you understand and fix your computer’s behavior.

Common Mistakes

Trying to read log files without proper permissions.

Most log files are owned by root and cannot be read by normal users, so the command will fail or show no output.

Use sudo before commands like 'sudo cat /var/log/syslog' to get permission to read the logs.

Using 'cat' on very large log files.

It floods the screen with too much text, making it hard to find useful information.

Use 'tail' or 'less' to view the end or scroll through the file comfortably.

Searching logs without case-insensitive options.

You might miss important messages if the word 'Error' is capitalized differently.

Use 'grep -i error /var/log/syslog' to find all variations of the word.

Summary

List log files in /var/log to see what logs are available.

Use 'tail' to view recent entries in large log files.

Use 'grep' to search logs for specific keywords like errors.

Use 'tail -f' to watch logs live as new events happen.

Practice

1. What is the primary purpose of files located in the /var/log/ directory on a Linux system?

easy

A. To hold user personal documents and files

B. To contain system configuration files

C. To save temporary files created during program execution

D. To store system and application logs recording events and errors

Solution

1. Step 1: Understand the role of /var/log/

   The /var/log/ directory is designed to keep logs about system and application activities.

2. Step 2: Differentiate from other directories

   Other directories like /home store user files, /etc holds configs, and /tmp stores temporary files.

3. Final Answer:

   To store system and application logs recording events and errors -> Option D

4. Quick Check:

   /var/log/ = system logs [OK]

Hint: Remember: /var/log holds logs, not configs or user files [OK]

Common Mistakes:

• Confusing /var/log with /etc for configs
• Thinking /var/log stores user documents
• Mixing up temporary files with logs

2. Which command correctly displays the last 10 lines of the /var/log/syslog file?

easy

A. tail /var/log/syslog

B. head /var/log/syslog

C. cat /var/log/syslog | head

D. less /var/log/syslog

Solution

1. Step 1: Recall command functions

   The tail command shows the last lines of a file; by default, it shows the last 10 lines.

2. Step 2: Compare options

   head shows the first lines, cat | head also shows first lines, and less opens a pager for browsing but does not directly show last lines.

3. Final Answer:

   tail /var/log/syslog -> Option A

4. Quick Check:

   tail = last 10 lines [OK]

Hint: Use tail to see last lines quickly [OK]

Common Mistakes:

• Using head instead of tail for last lines
• Confusing less with tail output
• Piping cat to head for last lines

3. What will be the output of the command grep 'error' /var/log/syslog | wc -l?

medium

A. It displays all lines from /var/log/syslog except those with 'error'

B. It shows the number of lines containing the word 'error' in /var/log/syslog

C. It counts all words in /var/log/syslog

D. It shows the first line containing 'error' in /var/log/syslog

Solution

1. Step 1: Understand grep and wc -l

   grep 'error' /var/log/syslog filters lines containing 'error'. wc -l counts the number of lines from that output.

2. Step 2: Combine command effects

   The pipeline counts how many lines in syslog have the word 'error'.

3. Final Answer:

   It shows the number of lines containing the word 'error' in /var/log/syslog -> Option B

4. Quick Check:

   grep + wc -l = count matching lines [OK]

Hint: grep filters lines; wc -l counts them [OK]

Common Mistakes:

• Thinking grep excludes matching lines
• Confusing wc -l with word count
• Assuming output shows lines, not count

4. You run tail -n 20 /var/log/auth.log but get an error: "tail: cannot open '/var/log/auth.log' for reading: Permission denied". What is the best way to fix this?

medium

A. Run the command with sudo: sudo tail -n 20 /var/log/auth.log

B. Change the file permissions with chmod 777 /var/log/auth.log

C. Copy the file to your home directory and run tail there

D. Use head instead of tail

Solution

1. Step 1: Identify permission issue

   The error says permission denied, meaning the user lacks rights to read the file.

2. Step 2: Use elevated privileges safely

   Using sudo runs the command as root, allowing access without changing file permissions.

3. Final Answer:

   Run the command with sudo: sudo tail -n 20 /var/log/auth.log -> Option A

4. Quick Check:

   Permission denied? Use sudo [OK]

Hint: Use sudo for restricted log files [OK]

Common Mistakes:

• Changing permissions insecurely with chmod 777
• Copying files without permissions
• Using head instead of fixing permissions

5. You want to monitor new entries added to /var/log/syslog in real-time and filter only lines containing the word 'failed'. Which command achieves this?

hard

A. cat /var/log/syslog | tail -f

B. grep failed /var/log/syslog

C. tail -f /var/log/syslog | grep failed

D. less /var/log/syslog | grep failed

Solution

1. Step 1: Understand real-time monitoring

   tail -f shows new lines added to a file live as they appear.

2. Step 2: Filter output for 'failed'

   Piping tail -f output to grep failed shows only lines containing 'failed' in real-time.

3. Final Answer:

   tail -f /var/log/syslog | grep failed -> Option C

4. Quick Check:

   tail -f + grep = live filtered log [OK]

Hint: Use tail -f piped to grep for live filtered logs [OK]

Common Mistakes:

• Using grep alone shows only current matches, no live updates
• Using cat with tail -f incorrectly
• Trying to grep inside less which is not live