General system logs combine routine notices, warnings, and errors from multiple sources. They are useful starting points, but their filenames and contents are routing-policy choices rather than universal Linux guarantees.
Logging · Lesson 3
General Logging
Learn how to discover, filter, follow, and correlate general Linux system logs.
Finding the Relevant Source
Depending on the distribution and configuration, general messages may appear in /var/log/syslog, /var/log/messages, the systemd journal, or more than one destination. Begin by identifying the host and incident interval, then inspect available sources:
$ ls -lh /var/log
$ journalctl --since '2026-08-31 09:00' --until '2026-08-31 09:15'
Application logs may live in their own subdirectories or an external service. Authentication, audit, package, database, and web-server records can be intentionally separated from the general stream.
Why should you not assume /var/log/messages exists on every Linux host?
Inspecting Text Logs
Use less for controlled navigation and tail for the newest records:
$ sudo less /var/log/syslog
$ sudo tail -n 100 /var/log/messages
Follow newly appended lines during a bounded reproduction with tail -F FILE. -F retries when a file is replaced during rotation, unlike a simple snapshot. Stop following with Ctrl-C and avoid leaving broad privileged sessions open.
What is tail -F useful for during a controlled reproduction?
Filtering Without Losing Context
Search a bounded file or journal interval rather than piping an unbounded live stream immediately:
$ grep -n -C 3 'connection refused' /var/log/example.log
$ journalctl -u example.service --since '10 minutes ago' --grep='connection refused'
Case, wording, rate limits, and localization can make a literal search incomplete. Record both successful and failed events, and keep surrounding lines because the cause may precede the visible error.
Why include lines around a matching error?
Including Rotated and Archived Logs
An incident may cross a rotation boundary. Active files, numbered archives, and compressed files can contain different parts of the same sequence. Tools such as zgrep and zless read gzip-compressed archives:
$ sudo zgrep -n 'connection refused' /var/log/example.log*.gz
Order results by actual timestamps, not suffix alone. Before copying evidence, preserve metadata and restrict access because logs can contain personal data or credentials.
What should you check when an incident spans a log rotation?
Lesson complete
You finished General Logging
You can now investigate general logs across files, journals, and rotation boundaries.
Discover destinations instead of assuming a universal filename.
Read a bounded interval and follow only during reproduction.
Keep temporal context around matching records.
Include rotated archives and protect sensitive evidence.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account