When a web server crashes, a network connection fails, or an application refuses to launch on your Linux machine, your first instinct should be to check the system logs. Linux operating systems are incredibly meticulous about recording every single event, error, and hardware state change. However, because these text files can grow to be thousands of lines long, opening them in a standard text editor is impractical. Learning how to view log files in Linux using specialised command-line tools is a fundamental skill for any system administrator.
In this technical troubleshooting guide, we will demonstrate how to navigate the /var/log directory and use the tail and less commands to monitor your system data efficiently.
Understanding the /var/log Directory
Almost all logs in a standard Linux distribution (like Ubuntu, Debian, or CentOS) are stored in the /var/log directory. Before you start reading files, it helps to know what you are looking for. Here are the most common logs you will encounter:
/var/log/syslog(or/var/log/messageson Red Hat): The primary system log containing general messages from the kernel and various services./var/log/auth.log(or/var/log/secure): Records all authentication events, including successful and failed SSH logins./var/log/dmesg: Contains kernel ring buffer information, primarily useful for troubleshooting hardware or driver issues during the boot process.
Method 1: Monitoring Real-Time Logs with ‘tail’
If you are actively trying to recreate a bug (for example, triggering an error on a website and watching what happens on the server), the tail command is your best friend. By default, tail outputs the last 10 lines of a file.
To view the end of your system log, open your terminal and type:
sudo tail /var/log/syslog
To monitor the log in real-time as new entries are written, add the -f (follow) flag:
sudo tail -f /var/log/syslog
Your terminal will remain open, and new text will appear instantly whenever the system generates a new event. To exit the real-time view, press Ctrl + C.
Method 2: Searching and Scrolling Logs with ‘less’
If you need to investigate an error that happened several hours ago, tail will not help you. Instead, you should use the less command, which allows you to scroll backward and forward through massive text files without loading the entire file into your RAM.
To open a log file with less, type:
sudo less /var/log/auth.log
- Use the Up and Down arrow keys to scroll line-by-line.
- Press the Spacebar to jump forward an entire page.
- To search for a specific keyword (like “Failed”), press the forward slash (/), type your keyword, and press Enter. Press n to jump to the next matching result.
- Press q to quit the viewer and return to the standard command prompt.
Frequently Asked Questions
Do log files take up too much hard drive space?
Usually, no. Linux uses a utility called logrotate that automatically compresses old log files (saving them as .gz archives) and eventually deletes them after a few weeks to prevent your hard drive from filling up.
By mastering these basic terminal commands, you can instantly diagnose complex system issues without relying on cumbersome graphical interfaces.
