Use journalctl first on a modern Ubuntu, Debian, or CentOS/RHEL-family system: systemd-journald collects kernel, boot, service, and application messages in a structured journal. Also inspect /var/log, because rsyslog and individual applications may write traditional text files there. The commands below show how to find current and previous-boot events, follow a service live, make journals survive reboot, route messages to files, and diagnose empty or inaccessible logs.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Quick command reference
Run these commands from a shell. Most system and security logs require sudo; access is also controlled by systemd-journal groups and file permissions.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
| Need | Command | What it shows |
|---|---|---|
| All journal entries | sudo journalctl |
Systemd journal entries in chronological order. |
| Current boot | sudo journalctl -b |
Messages collected since the machine last booted. |
| List boots | sudo journalctl --list-boots |
Boot IDs, offsets, and start/end times available to the journal. |
| Previous boot | sudo journalctl -b -1 |
Entries from the boot immediately before the current one. Use a boot ID from --list-boots when needed. |
| One service | sudo journalctl -u ssh.service |
Entries associated with the named systemd unit; replace it with the real unit name. |
| Follow a service | sudo journalctl -u ssh.service -f |
Prints new entries as the service writes them. |
| Kernel messages | sudo journalctl -k |
Kernel messages in the journal. |
| Recent text-file lines | sudo tail -n 100 /var/log/syslog |
The last 100 lines of a traditional file. |
| Follow a text file | sudo tail -f /var/log/syslog |
New lines appended to that file. |
| Search a text file | sudo grep -i 'error|fail|warning' /var/log/syslog |
Case-insensitive matches for common failure words. |
If a unit name is unknown, list installed units with your distribution’s normal systemd tooling or inspect the service’s package documentation; do not assume that every daemon uses ssh.service.
How Linux logging is organized
systemd-journald and the journal
systemd-journald is a system service that collects kernel messages, early-boot output, messages sent through the libc syslog interface, native Journal API records, service standard output and error, and audit records. It stores structured binary data rather than one plain-text file. journalctl is the supported query interface, so filters by boot, unit, or kernel source remain useful even when no obvious file exists under /var/log.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Journal storage has two locations. Persistent data is normally below /var/log/journal; volatile data is below /run/log/journal. The latter is a runtime filesystem and is cleared during reboot. The Storage= setting in /etc/systemd/journald.conf controls the policy, subject to the distribution’s defaults and available directories.
Traditional files and rsyslog
Many installations also run rsyslog. Journald can forward messages to rsyslog, which classifies them and writes text files under /var/log. Applications may bypass both services and create their own files, as web servers commonly do. Therefore an empty /var/log/syslog does not prove that the system has no logs: the journal may contain the records, rsyslog may not be installed, or the application may use a different path.
Where common files are on each distribution
File names are conventions, not guarantees. A minimal image, container, desktop installation, or customized rsyslog policy can omit them. Check the journal and the active configuration on the host you are administering.
| Distribution family | Primary query interface | Common traditional files | Typical rsyslog situation | Persistence policy | Package manager |
|---|---|---|---|---|---|
| Ubuntu | journalctl |
/var/log/auth.log (authorization, password prompts, sudo, remote logins); /var/log/kern.log (kernel); /var/log/syslog (general system information). Apache commonly uses /var/log/apache2/access.log and error.log. |
Often present and configured to route messages to files, but installation and rules vary. | Depends on whether /var/log/journal exists and on Storage=. |
apt |
| Debian | journalctl; journalctl -b --system is documented for system and kernel records. |
Frequently includes /var/log/syslog, /var/log/auth.log, and /var/log/kern.log when rsyslog rules provide them. |
May be installed or absent depending on the system profile; inspect /etc/rsyslog.conf and /etc/rsyslog.d/. |
Journald writes persistent binary data below /var/log/journal or volatile data below /run/log/journal. |
apt |
| CentOS/RHEL family | journalctl |
/var/log/messages, /var/log/secure, /var/log/maillog, /var/log/cron, and /var/log/boot.log are common. |
RHEL documentation describes journald collecting records and forwarding them to rsyslog, which sorts and writes files under /var/log; local policy can differ. |
Check the journal directory and active journald limits rather than assuming previous boots are available. | dnf |
View logs step by step
Inspect the current boot
- Start with
sudo journalctl -b. Page through output with the terminal pager and use its search facility to locate a timestamp, hostname, process, or error. - For only kernel activity, run
sudo journalctl -k. If you need the system scope explicitly on Debian, usesudo journalctl -b --system. - For a daemon, substitute its exact unit:
sudo journalctl -u ssh.service. A unit can have a different name, such as a templated instance or a distribution-specific spelling. - To watch a restart, open a second terminal and run
sudo journalctl -u ssh.service -f, then restart or exercise the service. Stop following withCtrl+C.
Inspect an earlier boot
- Run
sudo journalctl --list-boots. The output shows an offset such as0for the current boot, negative offsets for earlier boots, and a boot ID. - Query the immediately previous boot with
sudo journalctl -b -1. - If several boots are listed, use the displayed boot ID with
sudo journalctl -b BOOT_ID(replaceBOOT_IDwith the actual value). If no earlier boot appears, the journal is probably volatile, has already rotated those entries, or has insufficient permissions.
Read traditional files
Use less when you need to page through a file without loading it all into an editor:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo less /var/log/syslog
sudo less /var/log/messages
sudo less /var/log/auth.log
sudo less /var/log/secureChoose the file that exists on the target distribution. Follow a busy file with sudo tail -f /var/log/syslog, or show a bounded sample with sudo tail -n 100 /var/log/syslog. Search without opening an editor using sudo grep -i 'error|fail|warning' /var/log/syslog. If rotation has occurred, related files may have numeric or compressed suffixes; inspect the directory and the distribution’s rotation configuration before assuming data is missing.
Use the Ubuntu graphical viewer
On Ubuntu desktop, GNOME Logs can display, monitor, search, open, and close log files. It is a convenient front end for users who do not need a shell, but permissions and retention are still governed by journald, rsyslog, and the files themselves.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make journald logs survive a reboot
Do not promise a fixed number of days unless you have checked the active release’s limits. Journald can rotate according to settings such as SystemMaxUse=, RuntimeMaxUse=, and MaxRetentionSec=; available disk space and distribution defaults also matter.
Enable a persistent journal with the default policy
- Create the persistent directory:
sudo mkdir -p /var/log/journal - Apply systemd’s expected ownership and mode:
sudo systemd-tmpfiles --create --prefix /var/log/journal - Flush records that may currently be in the runtime journal:
sudo journalctl --flush - Confirm that journald is using disk space and can answer a query:
sudo journalctl --disk-usage sudo journalctl -b
This procedure creates persistent storage without replacing the distribution’s complete configuration. If you need an explicit policy, edit /etc/systemd/journald.conf and set Storage=persistent. After changing it, apply the configuration with:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo systemctl restart systemd-journaldRun sudo journalctl --disk-usage and a test query afterward. Keep an eye on disk usage and set appropriate size or retention limits for the release; unlimited growth is not a safe assumption.
Why previous boots are still unavailable
- The directory is absent: only
/run/log/journalwas used, so reboot removed the old data. - Limits removed old files: journald rotated entries to stay within configured size or time limits.
- The query is too broad or the unit is wrong: verify boot IDs with
--list-bootsand the exact unit name. - Access is restricted: retry with
sudoor have an administrator grant appropriate system-journal access.
Install and configure rsyslog routing
Use rsyslog when you need traditional text files, compatibility with existing monitoring, or forwarding rules. Do not overwrite a distribution’s main configuration casually. Put local rules in /etc/rsyslog.d/*.conf so package updates and vendor defaults remain easier to manage.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesInstall and enable the service
Ubuntu or Debian:
sudo apt update && sudo apt install rsyslog
CentOS or RHEL family:
sudo dnf install rsyslog
Enable and start:
sudo systemctl enable --now rsyslogSome systems already have rsyslog enabled. Installing it again is unnecessary; check its status before changing files.
Add a minimal local route
The following inputs accept local socket and kernel messages and write them to a file. Place the rule in a file such as /etc/rsyslog.d/10-local.conf rather than replacing /etc/rsyslog.conf:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
module(load="imuxsock")
module(load="imklog")
action(type="omfile" file="/var/log/syslog")Choose a path and permissions appropriate for the sensitivity of the messages. Existing vendor rules may already write the same events, so inspect the active configuration to avoid duplicate lines or unexpected volume.
Validate before restarting
- Check syntax without disrupting the running daemon:
sudo rsyslogd -N1 - Fix every reported error before proceeding. Common causes include an unmatched quote, an invalid module name, a directory that does not exist, or permissions that prevent opening the destination.
- Restart only after validation:
sudo systemctl restart rsyslog - Generate a harmless test message and inspect the destination:
logger -t logtest 'hello' sudo tail -n 20 /var/log/syslogOn a CentOS/RHEL-style route, check the configured
/var/log/messagesfile instead.
Ensure custom directories exist and are writable by the rsyslog process while remaining protected from untrusted users. A syntactically valid rule can still fail at runtime if its path, ownership, or mandatory access-control policy is wrong.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rotation, retention, and permissions
Traditional files
Distribution logrotate policies normally manage text files. Inspect /etc/logrotate.conf and /etc/logrotate.d/ on the host to learn the actual schedule, compression, post-rotate actions, and retention. Those values are release- and administrator-specific; do not infer them from a different Ubuntu, Debian, or CentOS installation.
Journal files
Journald rotates its own files and enforces its configured size and time controls. Review the active journald configuration, including system and runtime limits, before setting operational expectations. sudo journalctl --disk-usage reports current journal consumption.
Protect sensitive records
Authentication, authorization, audit, and service logs can contain usernames, hostnames, IP addresses, command lines, tokens, or other sensitive data. Restrict read access, use sudo only when necessary, and redact secrets before sending excerpts to a ticket or chat. Membership in a system-journal group can grant broad read access, so treat that membership as privileged.
Troubleshooting missing or empty logs
/var/log/syslog or /var/log/messages is empty or absent
- Query
sudo journalctl -bfirst. Journald may be collecting everything while rsyslog is not installed or not routing to that filename. - Check whether rsyslog is installed and running:
sudo systemctl status rsyslog. - Inspect
/etc/rsyslog.confand/etc/rsyslog.d/for an active rule targeting the file you expect. - Run
sudo rsyslogd -N1before any restart. Correct syntax and destination permissions, then restart and test withlogger.
Previous boots do not appear
Run sudo journalctl --list-boots. If only offset 0 is present and /var/log/journal does not exist, the host was likely using volatile storage. Create the directory, run systemd-tmpfiles --create --prefix /var/log/journal, flush with journalctl --flush, and verify. This cannot recover entries that were already discarded during earlier reboots.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe service query returns nothing
Confirm the unit spelling and whether the service actually uses systemd. A program launched manually, inside a container, or under a supervisor may log elsewhere. Query the general current-boot journal, then identify the service’s real unit before repeating journalctl -u.
You receive permission errors
Retry with sudo when policy permits. For regular, non-root access, ask an administrator to configure the appropriate system-journal group or file ACL rather than making logs world-readable. Text files can have different ownership and mode from the journal, so access to one does not imply access to the other.
Rsyslog fails after a configuration change
Use sudo rsyslogd -N1 to locate syntax errors, then inspect service status and the journal for startup diagnostics. Restore the last known-good snippet if necessary, correct module or action parameters, create missing destination directories, verify ownership, and restart only after the check passes. Keep local changes in a separate /etc/rsyslog.d/ file so rollback is straightforward.
A practical investigation workflow
- Record the incident time and affected host, then run
sudo journalctl -bto establish what the current boot saw. - Search the relevant unit with
sudo journalctl -u UNIT -fwhile reproducing the problem. - Separate kernel symptoms using
sudo journalctl -k. - If the event preceded a reboot, inspect
sudo journalctl --list-bootsand query the appropriate negative boot offset. - Compare the journal with the applicable text file, such as
/var/log/auth.log,/var/log/secure,/var/log/syslog, or/var/log/messages. - When a file is missing, determine whether rsyslog is installed, whether its rules route that facility, and whether logrotate moved or compressed older files.
- Before changing routing or retention, preserve relevant evidence and note the exact release, configuration file, command output, and time zone.
Defaults differ between releases and installation profiles. Verify the unit names, package availability, active journald settings, rsyslog rules, permissions, and rotation policy on the exact Ubuntu, Debian, or CentOS/RHEL host you maintain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
