If a service fails to start, a website displays an error, or you notice something unusual on the server, you will almost always find the answer in the log files. On modern Linux systems, logs are stored in two locations: in the systemd log, which you can view using the journalctl command, and in the text files within the /var/log directory.

Most logs can only be viewed by the root user or using sudo.

The systemd log: journalctl

journalctl displays all messages from the system and services managed by systemd in one place. The most useful switches are:

# Egy szolgáltatás naplója (pl. webszerver, SSH, adatbázis)
sudo journalctl -u httpd
sudo journalctl -u sshd
sudo journalctl -u mariadb

# Csak a legutóbbi 100 sor
sudo journalctl -u httpd -n 100

# Folyamatos követés (kilépés: Ctrl+C)
sudo journalctl -u httpd -f

# Időszak szerint
sudo journalctl --since "1 hour ago"
sudo journalctl --since "2026-10-20 08:00" --until "2026-10-20 09:00"

# Csak a hibák és annál súlyosabb üzenetek
sudo journalctl -p err

# Az aktuális, illetve az előző rendszerindítás óta
sudo journalctl -b
sudo journalctl -b -1

# Kernel üzenetek (pl. memóriahiány, lemezhibák)
sudo journalctl -k

The switches can be combined, for example: sudo journalctl -u nginx -p err --since today.

journalctl displays the output in pages: you can scroll using the space bar, enter a search term after the /, and press the q key to exit.

Will the logs remain after a restart?

If journalctl --list-boots shows only one system boot, the journal is stored only in memory and is lost upon reboot. On the AlmaLinux 10 cloud image, the test showed the following: there was no /var/log/journal directory, and even after several reboots, only the current boot was visible. To enable persistent storage:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

From this point onwards, the log is written to the disk; entries from previous boots are not included. In the test, after the next reboot, the --list-boots command showed two boots, and journalctl -b -1 also displayed the log for the previous boot.

The space occupied by the log can be checked using the journalctl --disk-usage command and can, for example, be reduced to 500 MB:

sudo journalctl --vacuum-size=500M

The /var/log directory

Many services (particularly web servers and email) write to their own text log files. The most common ones are:

Log	AlmaLinux, Rocky Linux	Ubuntu, Debian
General system log	/var/log/messages	/var/log/syslog
Logins, SSH, sudo	/var/log/secure	/var/log/auth.log
Apache error log	/var/log/httpd/error_log	/var/log/apache2/error.log
Apache access log	/var/log/httpd/access_log	/var/log/apache2/access.log
Nginx	/var/log/nginx/error.log, access.log	/var/log/nginx/error.log, access.log
Correspondence	/var/log/maillog	/var/log/mail.log
Package Manager	/var/log/dnf.log	/var/log/apt/history.log

From Debian 12 onwards, rsyslog is not installed by default, so the files /var/log/syslog and /var/log/auth.log may be missing; in this case, the same messages can be viewed using the journalctl command. In our test, neither file was present on the Debian 12 cloud image; however, on Ubuntu 24.04 and AlmaLinux 10, rsyslog is running and the text logs are generated there.

On a cPanel server, the Apache error log is located at /etc/apache2/logs/error_log, whilst the mail log (Exim) is in the /var/log/exim_mainlog file. To interpret Exim messages, see: Explanation of the various Exim status codes.

Reading log files using the tail, less and grep commands

# Az utolsó 50 sor
sudo tail -n 50 /var/log/httpd/error_log

# Folyamatos követés: az új sorok azonnal megjelennek (kilépés: Ctrl+C)
sudo tail -f /var/log/httpd/error_log

# Lapozva, a fájl végéről indítva
sudo less +G /var/log/messages

# Keresés egy kifejezésre
sudo grep "Failed password" /var/log/secure
sudo grep -i "example.hu" /var/log/httpd/access_log

When troubleshooting, it is often easiest to monitor the log using tail -f in a terminal whilst simultaneously reloading the faulty page in a browser: the relevant line will appear immediately. For information on displaying the lines before and after a match, see the article ‘Grep: displaying lines before and after a match’.

Older, compressed logs

logrotate regularly (typically weekly) rotates and archives log files, so older entries are stored in files named .1, .2.gz or with a date (e.g. messages-20261019). On AlmaLinux and Rocky Linux, date-based filenames are typical, without /etc/logrotate.conf (the compress option is commented out in the /etc/logrotate.conf file), whilst on Debian and Ubuntu, sequentially numbered, .gz-compressed files are used. You can search within the compressed files using the zgrep and zless commands without extracting them:

sudo zgrep "Out of memory" /var/log/messages-*

If a log file has grown too large and is taking up too much disk space, our article on locating and removing large error_log files will help.