{"id":582,"date":"2024-09-04T08:58:26","date_gmt":"2024-09-04T05:58:26","guid":{"rendered":"https:\/\/itgen.itbumper.com\/?page_id=582"},"modified":"2024-09-09T09:57:05","modified_gmt":"2024-09-09T06:57:05","slug":"ubuntu-server-log-files-overview","status":"publish","type":"page","link":"https:\/\/itgen.itbumper.com\/?page_id=582","title":{"rendered":"0012_Linux Log Files Overview"},"content":{"rendered":"\n\n<p style=\"text-align: justify;\">Log files on Ubuntu Server are crucial for monitoring system activities, troubleshooting issues, and ensuring security. They store information about system events, user activities, and application behavior.<\/p>\n<h4>Common Log Locations and Descriptions<\/h4>\n<ol>\n<li>\n<p><strong><code>\/var\/log\/syslog<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: The main system log file records general system events, including boot messages, service start-ups, and shutdowns.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/auth.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs all authentication-related events, such as login attempts, sudo usage, and SSH connections.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/kern.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains messages from the kernel, including hardware errors, device detection, and kernel panics.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/dmesg<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Captures kernel ring buffer messages, which include boot-time hardware detection and initialization logs.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/apt\/history.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Records a history of package installations, upgrades, and removals via the APT package manager.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/apt\/term.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains detailed terminal output from package installations, including errors and warnings during APT operations.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/faillog<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Stores failed login attempts data, tracking how many failed attempts occurred for each user.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/boot.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs the system boot process, including messages from various services and daemons that start during boot.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/daemon.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs messages from system daemons (background services) that run in the background, such as <code>cron<\/code>, <code>ntpd<\/code>, etc.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/messages<\/code><\/strong> (if available)<\/p>\n<ul>\n<li><strong>Description<\/strong>: Another general system log file, similar to <code>\/var\/log\/syslog<\/code>, that, records various system events.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/mail.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Log messages related to the mail system, including emails sent and received by the server.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/ufw.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs firewall (Uncomplicated Firewall &#8211; UFW) events, including allowed and blocked connections.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/apache2\/<\/code><\/strong> (for Apache web server)<\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains logs for the Apache web server. Key files include:\n<ul>\n<li><strong><code>access.log<\/code><\/strong>: Records all requests made to the server.<\/li>\n<li><strong><code>error.log<\/code><\/strong>: Logs server errors, warnings, and other diagnostic information.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/mysql\/<\/code><\/strong> (for MySQL\/MariaDB database server)<\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains logs for the MySQL or MariaDB database server. Key files include:\n<ul>\n<li><strong><code>error.log<\/code><\/strong>: Logs errors encountered by the database server.<\/li>\n<li><strong><code>slow-query.log<\/code><\/strong>: Records queries that take longer than a specified time to execute.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/nginx\/<\/code><\/strong> (for Nginx web server)<\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains logs for the Nginx web server. Key files include:\n<ul>\n<li><strong><code>access.log<\/code><\/strong>: Records all requests made to the server.<\/li>\n<li><strong><code>error.log<\/code><\/strong>: Logs server errors, warnings, and other diagnostic information.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/btmp<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs failed login attempts, similar to <code>\/var\/log\/faillog<\/code>, but in a binary format.<\/li>\n<li><strong>\u0427\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c<\/strong>: \u041d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0432 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u0442\u0435.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/wtmp<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs successful login attempts, user logouts, and system boot\/reboots in a binary format.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/cron.log<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Logs messages related to <code>cron<\/code> jobs, including execution times and any errors.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>\/var\/log\/journal\/<\/code><\/strong><\/p>\n<ul>\n<li><strong>Description<\/strong>: Contains logs from <code>systemd-journald<\/code>, which includes detailed system logs in a binary format.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h3>1. <code>cat<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> A simple utility to display the contents of files on the screen.\n<p><strong>Note :<\/strong> <code>cat<\/code> Outputs the file content without any filtering or formatting.<\/p>\n<\/li>\n<\/ul>\n<p><strong>Example Usage:<\/strong><\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\ncat \/var\/log\/syslog\n<\/pre><\/div>\n\n<h3>2. <code>less<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> An interactive file viewer that allows scrolling and searching within the file.<\/li>\n<\/ul>\n<p><strong>Useful Keys:<\/strong><\/p>\n<ul>\n<li><strong><code>\/string<\/code><\/strong> \u2014 Search for a string in the file.<\/li>\n<li><strong><code>n<\/code><\/strong> \u2014 Go to the next search match.<\/li>\n<li><strong><code>q<\/code><\/strong> \u2014 Quit the viewer.<\/li>\n<\/ul>\n<p><strong>Example Usage:<\/strong><\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nless \/var\/log\/syslog\n<\/pre><\/div>\n\n<h3>3. <code>tail<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> Displays the last lines of a file. Useful for viewing logs as they are updated.<\/li>\n<\/ul>\n<p><strong>Keys and Examples:<\/strong><\/p>\n<ul>\n<li><strong><code>-f<\/code><\/strong> \u2014 Follow the file as it is updated<\/li>\n<li><strong><code>-n N<\/code><\/strong> \u2014 Show the last N lines&nbsp;<\/li>\n<\/ul>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\ntail -f \/var\/log\/syslog\ntail -n 50 \/var\/log\/syslog\n<\/pre><\/div>\n\n<h3>4. <code>head<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> Displays the first lines of a file.<\/li>\n<\/ul>\n<p><strong>Example Usage:<\/strong><\/p>\n<p><strong><code>-n N<\/code><\/strong> \u2014 Show the first N lines:<\/p>\n<div class=\"dark bg-gray-950 contain-inline-size rounded-md border-[0.5px] border-token-border-medium\">\n<div class=\"flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md\">&nbsp;<\/div>\n<\/div>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nhead \/var\/log\/syslog\nhead -n 50 \/var\/log\/syslog\n<\/pre><\/div>\n\n<h3>5. <code>grep<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> Searches for lines that match a specified pattern.<\/li>\n<\/ul>\n<p><strong>Keys and Examples:<\/strong><\/p>\n<ul>\n<li><strong><code>-i<\/code><\/strong> \u2014 Ignore case;\n<div class=\"dark bg-gray-950 contain-inline-size rounded-md border-[0.5px] border-token-border-medium\">\n<div class=\"flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md\">&nbsp;<\/div>\n<\/div>\n<\/li>\n<li><strong><code>-r<\/code><\/strong> \u2014 Recursive search through all files in a directory;\n<div class=\"dark bg-gray-950 contain-inline-size rounded-md border-[0.5px] border-token-border-medium\">\n<div class=\"flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md\">&nbsp;<\/div>\n<\/div>\n<\/li>\n<li><strong><code>-A N<\/code><\/strong> \u2014 Show N lines after the match;\n<div class=\"dark bg-gray-950 contain-inline-size rounded-md border-[0.5px] border-token-border-medium\">\n<div class=\"flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md\">&nbsp;<\/div>\n<\/div>\n<\/li>\n<li><strong><code>-B N<\/code><\/strong> \u2014 Show N lines before the match:\n<div class=\"dark bg-gray-950 contain-inline-size rounded-md border-[0.5px] border-token-border-medium\">\n<div class=\"flex items-center relative text-token-text-secondary bg-token-main-surface-secondary px-4 py-2 text-xs font-sans justify-between rounded-t-md\">&nbsp;<\/div>\n<\/div>\n<\/li>\n<\/ul>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\ngrep -i error \/var\/log\/syslog\ngrep -r &quot;connection&quot; \/var\/log\/\ngrep -A 5 &quot;error&quot; \/var\/log\/syslog\ngrep -B 5 &quot;error&quot; \/var\/log\/syslog\n<\/pre><\/div>\n\n<h3>6. <code>journalctl<\/code><\/h3>\n<ul>\n<li><strong>Description:<\/strong> A tool to view logs managed by the <code>systemd<\/code> system. It provides convenient filtering and searching capabilities.<\/li>\n<\/ul>\n<p><strong>Keys and Examples \/ \u041a\u043b\u044e\u0447\u0438 \u0438 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f:<\/strong><\/p>\n<ul>\n<li><strong><code>-b<\/code><\/strong> \u2014 Show logs from the current boot;<\/li>\n<li><strong><code>-u &lt;service&gt;<\/code><\/strong> \u2014 Show logs for a specific service;<\/li>\n<li><strong><code>-n<\/code><\/strong> &#8211; Show recent events in the system (-n 20, 20 last lines);<\/li>\n<li><strong><code>-f<\/code> &#8211; <\/strong>&nbsp;Show real-time events;<\/li>\n<li><strong><code>-p &lt;priority&gt;<\/code><\/strong> \u2014 Filter logs by priority level:<\/li>\n<\/ul>\n<p><strong>Priority Levels \/ \u0423\u0440\u043e\u0432\u043d\u0438 \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u0430:<\/strong><\/p>\n<ul>\n<li><code>emerg<\/code> (0) \u2014 Emergency messages \/ the system is inoperable;<\/li>\n<li><code>alert<\/code> (1) \u2014 Alerts \/ Immediate intervention is required;<\/li>\n<li><code>crit<\/code> (2) \u2014 Critical errors \/ <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"0:11\">critical<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"12:9\">condition<\/span>;<\/li>\n<li><code>err<\/code> (3) \u2014 Errors;<\/li>\n<li><code>warning<\/code> (4) \u2014 Warnings;<\/li>\n<li><code>notice<\/code> (5) \u2014 Notices \/ everything is fine, but you should pay attention;<\/li>\n<li><code>info<\/code> (6) \u2014 Informational messages;<\/li>\n<li><code>debug<\/code> (7) \u2014 Debug messages.&nbsp;<\/li>\n<\/ul>\n<ul>\n<li><strong><code>-f<\/code><\/strong> \u2014 Follow the log in real-time;<\/li>\n<li><strong style=\"font-size: revert;\"><code>--since<\/code><\/strong><span style=\"font-size: revert;\"> and <\/span><strong style=\"font-size: revert;\"><code>--until<\/code><\/strong><span style=\"font-size: revert;\"> \u2014 Show logs from a specific period&nbsp;<\/span><\/li>\n<\/ul>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -b\njournalctl -u ssh.service\njournalctl -p 4 err\njournalctl -f\njournalctl --since &quot;2024-09-01 00:00:00&quot; --until &quot;2024-09-02 00:00:00&quot;\njournalctl ---since yesterday\njournalctl --since 09:00 --until now\njournalctl --since 10:00 --until &quot;1 hour ago&quot;\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\"><strong>Viewing logs of previous sessions<\/strong><\/p>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">Using journalctl, you can view information about previous sessions in the system \u2014 in some cases, this can be useful.<br>However, remember that saving information about previous sessions is not supported by default in all Linux distributions. Sometimes, it needs to be activated.<\/p>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">To do this, open the journal.conf configuration file, find the [Journal] section in it, and change the value of the storage parameter to persistent:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nsudo nano \/etc\/systemd\/journald.conf\n...\n&#x5B;Journal]\nStorage=persistent\n<\/pre><\/div>\n\n<p>You can view the list of previous downloads using the command:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl --list-boots\n#Example output\n 0 177999c1b6e746fca06a7ca53dd02155 Mon 2024-09-02 15:34:20 PDT\u2014Tue 2024-09-03 22:04:07 PDT\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">Its output consists of four columns. The first indicates the serial number of the download, the second \u2014 its ID, and the third \u2014 the date and time. To view the log for a specific download, you can use the IDs from both the first and second columns:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -b 0\n#or\njournalctl -b 177999c1b6e746fca06a7ca53dd02155\n<\/pre><\/div>\n\n<p><\/p>\n<p>You can view logs for any process by specifying its identification number (PID) in the journalctl command, for example:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl _PID=789\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">The _UID and _GID filters are used to view logs of processes running on behalf of a specific user or group, respectively. Suppose we have a web server running on behalf of the www-data user. Let&#8217;s first determine the ID of this user and then use it:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nid -u www-data\n#Example output\n35\njournalctl _UID=35\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">To display a list of users and groups on the console about which there are entries in the logs, you can do this:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -F _UID\njournalctl -F _GUID\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\">Other filters can be used with the journalctl command. You can view the list of all available filters by running the command.<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nman systemd.journal-fields\n<\/pre><\/div>\n\n<p>You can also view logs for a process by specifying the path to it. Sometimes, you can get more detailed information this way (for example, view records for all child processes:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl \/usr\/bin\/docker\n<\/pre><\/div>\n\n<p>The <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"48:1\">&#8211;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"49:1\">k<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"51:3\">or<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"55:2\">&#8212;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"57:5\">dmesg<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"42:5\">option<\/span> is <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"29:12\">used<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"0:3\">to<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"4:9\">view<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"24:4\">kernel<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"14:9\">messages<\/span>:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -k\n#or\njournalctl --dmesg\n# Kernel boot 2 messages\njournalctl -k -b -2\n<\/pre><\/div>\n\n<h5>&nbsp;<\/h5>\n<h5 style=\"text-align: center;\">Logging logs to standard output<\/h5>\n<p style=\"text-align: justify;\">By default, journalctl uses the external <em>less<\/em> utility to output log messages. In this case, applying standard utilities for processing text data (for example, grep) to them is impossible. This problem is easily solved: use the &#8211;no-pager option and all messages will be written to standard output:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl --no-pager\n<\/pre><\/div>\n\n\n<p>Afterward, they can be transferred to other utilities for further processing or saved in a text file.<\/p>\n\n\n<h5 style=\"text-align: center;\" data-tadv-p=\"keep\">Choosing the output format<\/h5>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">Using the -o option, you can convert log data into various formats, which facilitates their parsing and further processing, for example:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl  -u nginx.service -o json\n\n{ &quot;__CURSOR&quot; : &quot;s=13a21661cf4948289c63075db6c25c00;i=116f1;b=81b58db8fd9046ab9f847ddb82a2fa2d;m=19f0daa;t=50e33c33587ae;x=e307daadb4858635&quot;, &quot;__REALTIME_TIMESTAMP&quot; : &quot;1422990364739502&quot;, &quot;__MONOTONIC_TIMESTAMP&quot; : &quot;27200938&quot;, &quot;_BOOT_ID&quot; : &quot;81b58db8fd9046ab9f847ddb82a2fa2d&quot;, &quot;PRIORITY&quot; : &quot;6&quot;, &quot;_UID&quot; : &quot;0&quot;, &quot;_GID&quot; : &quot;0&quot;, &quot;_CAP_EFFECTIVE&quot; : &quot;3fffffffff&quot;, &quot;_MACHINE_ID&quot; : &quot;752737531a9d1a9c1e3cb52a4ab967ee&quot;, &quot;_HOSTNAME&quot; : &quot;desktop&quot;, &quot;SYSLOG_FACILITY&quot; : &quot;3&quot;, &quot;CODE_FILE&quot; : &quot;src\/core\/unit.c&quot;, &quot;CODE_LINE&quot; : &quot;1402&quot;, &quot;CODE_FUNCTION&quot; : &quot;unit_status_log_starting_stopping_reloading&quot;, &quot;SYSLOG_IDENTIFIER&quot; : &quot;systemd&quot;, &quot;MESSAGE_ID&quot; : &quot;7d4958e842da4a758f6c1cdc7b36dcc5&quot;, &quot;_TRANSPORT&quot; : &quot;journal&quot;, &quot;_PID&quot; : &quot;1&quot;, &quot;_COMM&quot; : &quot;systemd&quot;, &quot;_EXE&quot; : &quot;\/usr\/lib\/systemd\/systemd&quot;, &quot;_CMDLINE&quot; : &quot;\/usr\/lib\/systemd\/systemd&quot;, &quot;_SYSTEMD_CGROUP&quot; : &quot;\/&quot;, &quot;UNIT&quot; : &quot;nginx.service&quot;, &quot;MESSAGE&quot; : &quot;Starting A high performance web server and a reverse proxy server...&quot;, &quot;_SOURCE_REALTIME_TIMESTAMP&quot; : &quot;1422990364737973&quot; }\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\">A JSON object can be represented in a more structured and human-readable form by specifying the json-pretty or json-sse format:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -u nginx.service -o json-pretty\n\n{\n    &quot;__CURSOR&quot; : &quot;s=13a21661cf4948289c63075db6c25c00;i=116f1;b=81b58db8fd9046ab9f847ddb82a2fa2d;m=19f0daa;t=50e33c33587ae;x=e307daadb4858635&quot;,\n    &quot;__REALTIME_TIMESTAMP&quot; : &quot;1422990364739502&quot;,\n    &quot;__MONOTONIC_TIMESTAMP&quot; : &quot;27200938&quot;,\n    &quot;_BOOT_ID&quot; : &quot;81b58db8fd9046ab9f847ddb82a2fa2d&quot;,\n    &quot;PRIORITY&quot; : &quot;6&quot;,\n    &quot;_UID&quot; : &quot;0&quot;,\n    &quot;_GID&quot; : &quot;0&quot;,\n    &quot;_CAP_EFFECTIVE&quot; : &quot;3fffffffff&quot;,\n    &quot;_MACHINE_ID&quot; : &quot;752737531a9d1a9c1e3cb52a4ab967ee&quot;,\n    &quot;_HOSTNAME&quot; : &quot;desktop&quot;,\n    &quot;SYSLOG_FACILITY&quot; : &quot;3&quot;,\n    &quot;CODE_FILE&quot; : &quot;src\/core\/unit.c&quot;,\n    &quot;CODE_LINE&quot; : &quot;1402&quot;,\n    &quot;CODE_FUNCTION&quot; : &quot;unit_status_log_starting_stopping_reloading&quot;,\n    &quot;SYSLOG_IDENTIFIER&quot; : &quot;systemd&quot;,\n    &quot;MESSAGE_ID&quot; : &quot;7d4958e842da4a758f6c1cdc7b36dcc5&quot;,\n    &quot;_TRANSPORT&quot; : &quot;journal&quot;,\n    &quot;_PID&quot; : &quot;1&quot;,\n    &quot;_COMM&quot; : &quot;systemd&quot;,\n    &quot;_EXE&quot; : &quot;\/usr\/lib\/systemd\/systemd&quot;,\n    &quot;_CMDLINE&quot; : &quot;\/usr\/lib\/systemd\/systemd&quot;,\n    &quot;_SYSTEMD_CGROUP&quot; : &quot;\/&quot;,\n    &quot;UNIT&quot; : &quot;nginx.service&quot;,\n    &quot;MESSAGE&quot; : &quot;Starting A high performance web server and a reverse proxy server...&quot;,\n    &quot;_SOURCE_REALTIME_TIMESTAMP&quot; : &quot;1422990364737973&quot;\n}\n<\/pre><\/div>\n\n<p>In addition to JSON, log data can be converted to the following formats:<\/p>\n<p><strong><code>cat<\/code><\/strong> \u2014 only messages from logs without service fields;<br>export is a binary format suitable for exporting or backing up logs;<br><strong><code>short<\/code><\/strong>&nbsp;\u2014 syslog output format;<br><strong><code>short-iso<\/code><\/strong>&nbsp;\u2014 syslog output format with timestamps in ISO 8601 format;<br><strong><code>short-monotonic<\/code><\/strong>&nbsp;\u2014 syslog output format with monotonic timestamp (monotonic timestamp);<br><strong><code>short-precise<\/code><\/strong>&nbsp;\u2014 syslog output format with accurate timestamps (the time of events is specified with microsecond accuracy);<br><strong><code>verbose<\/code><\/strong>&nbsp;&#8211; is the most detailed format for presenting data (including even those fields not displayed in other formats).<\/p>\n<h5 data-tadv-p=\"keep\">&nbsp;<\/h5>\n<h5 style=\"text-align: center;\" data-tadv-p=\"keep\">Logging management<\/h5>\n<p style=\"text-align: left;\" data-tadv-p=\"keep\"><strong>Determining the current volume of logs<\/strong><\/p>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">Over time, the volume of logs grows, and they take up more and more space on the hard disk. To find out the amount of logs currently available, use the command:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl --disk-usage\n<\/pre><\/div>\n\n<p><strong><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"8:5\">Log<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"0:7\">Rotation<\/span><\/strong><\/p>\n<p style=\"text-align: justify;\"><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"33:5\">Log<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"25:7\">rotation<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"39:14\">is<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"15:9\">configured<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"56:7\">using<\/span> the <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"70:2\">&#8212;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"72:6\">vacuum<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"78:1\">&#8211;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"79:4\">size<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"84:1\">and<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"86:2\">&#8212;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"88:6\">vacuum<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"94:1\">&#8211;<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"95:4\">time<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"64:5\">options<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"99:1\">.<\/span> The <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"102:6\">first<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"109:2\">of<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"112:3\">them<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"116:13\">sets<\/span> the <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"130:9\">maximum<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"140:10\">allowable<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"151:6\">size<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"158:3\">for<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"180:5\">logs<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"162:8\">stored<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"171:2\">on<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"174:5\">disk<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"186:1\">(<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"187:1\">in<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"189:5\">our<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"195:7\">example<\/span>, <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"205:1\">5<\/span> <span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"207:2\">GB<\/span><span class=\"EzKURWReUAB5oZgtQNkl\" data-src-align=\"209:1\">)<\/span>:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nsudo journalctl --vacuum-size=5G\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\">The extra files will be automatically deleted as soon as the volume of logs exceeds the specified figure.<br>The &#8211;vacuum-time option works similarly. It sets the retention period for logs, after which they will be automatically deleted:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nsudo journalctl --vacuum-time=1years\n<\/pre><\/div>\n\n<p><strong>Configuring log rotation in the configuration file<\/strong><\/p>\n<p style=\"text-align: justify;\">Log rotation settings can also be specified in the configuration file \/etc\/systemd\/journald.conf, which includes, among others, the following parameters:<\/p>\n<p style=\"text-align: justify;\"><span style=\"background-color: #c4c2c2;\"><em>SystemMaxUse=<\/em><\/span> the maximum amount that logs can occupy on disk;<br><span style=\"background-color: #c4c2c2;\"><em>SystemKeepFree=<\/em><\/span> the amount of free space that should remain on the disk after saving logs;<br><span style=\"background-color: #c4c2c2;\"><em>SystemMaxFileSize=<\/em><\/span> the size of the log file, after which it should be deleted from disk;<br><span style=\"background-color: #c4c2c2;\"><em>RuntimeMaxUse=<\/em><\/span> the maximum amount that logs can occupy in the file system \/run;<br><span style=\"background-color: #c4c2c2;\"><em>RuntimeKeepFree=<\/em><\/span> the amount of free space that should remain in the \/run file system after saving logs;<br><span style=\"background-color: #c4c2c2;\"><em>RuntimeMaxFileSize=<\/em><\/span> the size of the log file, after which it should be deleted from the \/run file system.<\/p>\n<h5 style=\"text-align: center;\">Centralized storage of logs<\/h5>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">One of the most common tasks in the work of a system administrator is to set up the collection of logs from several machines and then place them in a centralized repository.<br>Systems provides special components for solving this problem: <a href=\"http:\/\/www.freedesktop.org\/software\/systemd\/man\/systemd-journal-remote.html\">systemd-journal-remote<\/a>, <a href=\"http:\/\/www.freedesktop.org\/software\/systemd\/man\/systemd-journal-upload.html\">systemd-journal-upload<\/a> and <a href=\"http:\/\/www.freedesktop.org\/software\/systemd\/man\/systemd-journal-gatewayd.service.html\">systemd-journal-gatewayd<\/a>.<\/p>\n<p style=\"text-align: justify;\" data-tadv-p=\"keep\">Using the systemd-journal-remote command, you can receive logs from remote hosts and save them (the systemd-journal-gatewayd daemon must be running on each of these hosts), for example:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nsystemd-journal-remote \u2212\u2212url https:\/\/some.host:19531\/\n<\/pre><\/div>\n\n<p style=\"text-align: justify;\">As a result of executing the above command, logs from the host https:\/\/some.host \/ will be saved in the var\/log\/journal\/some.host\/remote-some~host directory.journal .<\/p>\n<p style=\"text-align: justify;\">Using the systemd-journal-remote command, you can also put the logs available on the local machine in a separate directory, for example:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\njournalctl -o export\u00a0| systemd-journal-remote -o \/tmp\/dir -\n<\/pre><\/div>\n\n<p>The systemd-journal-upload command is used to upload logs from the local machine to the remote storage:<\/p>\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nsystemd-journal-upload --url https:\/\/some.host:19531\/\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"<p>Log files on Ubuntu Server are crucial for monitoring system activities, troubleshooting issues, and ensuring security. They store information about system events, user activities, and application behavior. Common Log Locations and Descriptions \/var\/log\/syslog Description: The main system log file records general system events, including boot messages, service start-ups, and shutdowns. \/var\/log\/auth.log Description: Logs all authentication-related &hellip; <a href=\"https:\/\/itgen.itbumper.com\/?page_id=582\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;0012_Linux Log Files Overview&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"categories":[],"tags":[],"_links":{"self":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/582"}],"collection":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=582"}],"version-history":[{"count":18,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/582\/revisions"}],"predecessor-version":[{"id":606,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/582\/revisions\/606"}],"wp:attachment":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}