On ubuntu, logs can be accessed using any of the 200+ text processing tools that all Unix-like OSes have. Logs are typically placed in /var/log/ ... somewhere. Different programs may have their own logs, but many will use the system log ... "syslog". This directory is for server/system logs. Individual logs for desktop programs and programs manually installed typically are placed into other locations, as configured for that specific program.
The logs that the system uses can also be accessed using journalctl. It has many options and can be configured to retain as much logs as you like, ship the logs to a different log server, and to not retain any logs at all. I wish I could say what the defaults were for journalctl, but I've always been unhappy with the defaults either not retaining any logs between reboots or allowing logs to grow much too large, so I typically tell it to write logs and keep 500MB worth. That's usually 5-10 reboots - which is about 6 months for my systems.
Some notes I have on log files:
Code:
== Log Files ==
journalctl -xe # See errors for last service
journalctl -b -1 # See prior boot log
journalctl -b -3 # See 3 boot logs ago
journalctl -b # See current boot log
journalctl -S today # See logs for today, from midnight
journalctl -xe -S today # See errors for today, from midnight
journalctl --disk-usage # See log file disk use
sudo journalctl --vacuum-size=200M # Drop log file size to 200M, if possible.
journalctl can be used to specify specific periods to limit searches, which is why noting the time of an issue within a few minutes is always a good idea. There's a full manpage on most Linux commands that shows all the available options and arguments to the command to make getting the exact output desired possible.
I didn't show any grep with journalctl. It has a regex engine too, so using that would be a good idea.
Before journalctl, I'd use
Code:
sudo egrep -i 'erro|warn' /var/log/*g
as my starting point to figure out issues. The sudo is necessary for some text log files, but not all. Use as needed.
Bookmarks