Logs record events emitted by the kernel, services, applications, and security components. They support troubleshooting and auditing, but only when collection is working, timestamps are understood, and the relevant source is included.
Logging · Lesson 1
System Logging
Learn how Linux log sources, collectors, storage, and viewing tools fit together.
Following a Log Message
A logging path has several distinct parts:
- A source emits an event.
- A collector accepts and enriches it.
- Routing and retention rules choose storage or forwarding destinations.
- A viewer queries the stored records.
On a systemd host, systemd-journald commonly collects service standard output, kernel messages, and journal-native or syslog messages. A syslog daemon such as rsyslog may also receive messages and write traditional text files or forward them. Applications can instead maintain their own files or external telemetry.
Which component decides where accepted messages are stored or forwarded?
Discovering Available Logs
Do not assume every host has the same files. Inspect the active logging services and local configuration:
$ systemctl --type=service --state=running | grep -E 'journal|syslog'
$ ls -la /var/log
$ journalctl --disk-usage
/var/log/syslog is common on Debian-family systems using compatible routing, while /var/log/messages is common elsewhere. Either may be absent on a journal-only host. Application documentation and unit configuration can identify additional destinations.
What does a missing /var/log/syslog file necessarily mean?
Querying the Journal
Start with a bounded query instead of dumping the entire journal:
$ journalctl -b -p warning
$ journalctl -u ssh.service --since '1 hour ago'
-b selects the current boot, -p filters by priority, and -u filters by a unit. Unit names and retained boots differ by host. Use journalctl --list-boots to see available boots and journalctl -f to follow new records while reproducing an issue.
Which option limits a journalctl query to the current boot?
Reading Records in Context
A traditional syslog-style line can look like:
Jan 27 07:41:32 icebox anacron[4650]: Job `cron.weekly' started
It contains a timestamp, host, program and PID, then a message. Treat message text as application output, not a guaranteed structured fact. Check timezone, clock synchronization, boot ID, PID reuse, and records immediately before and after the event. Journal fields can provide stronger identifiers than the rendered text alone.
Logs may contain usernames, addresses, paths, tokens, or other sensitive data. Use least-privilege access, redact exports, and preserve originals and timestamps during an investigation.
What should you do before sharing a log excerpt externally?
Lesson complete
You finished System Logging
You can now locate and query Linux logs without assuming one universal storage path.
Separate event sources, collectors, routing, storage, and viewers.
Discover the host's active logging configuration.
Use bounded journal queries for a unit, boot, time, or priority.
Correlate records in context and protect sensitive log data.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account