Welcome to the first episode of our series “Become a Linux Debug Expert”. Today we start with the fundamentals: we will check where the system stores key information and how to understand the differences between system logs, kernel logs, and application logs.
Introduction to the world of Linux diagnostics
Understanding how the operating system communicates its states is the most important skill for any administrator. In this five-part series we will guide you from basic file locations to advanced analysis automation. If you feel that 50 popular questions about the Linux system is not enough for you, this series is exactly for you.
Where are logs in Linux: The /var/log directory
In Ubuntu, the heart of diagnostics is the /var/log directory. This is where most records of system activity end up. You will find both text files and binary logs handled by journald. Here are the most important locations you should look at first:
/var/log/syslog: The main system log, where most messages land./var/log/auth.log: Tracks login attempts and the use of thesudocommand./var/log/kern.log: Contains messages generated directly by the system kernel./var/log/dpkg.log: Records package installations and upgrades.
It is worth noting that this structure evolves. In newer Ubuntu releases, journalctl plays an increasingly important role, aggregating data and making traditional text files less relevant for real-time viewing. If you are interested in optimizing system performance, also check our guide on how to limit CPU and RAM usage by processes in Linux.
System, kernel, and application logs – what is the difference?
To debug effectively, you need to know what you are looking for:
- Kernel logs: This is the lowest level of communication. If hardware refuses to obey or the system suddenly hangs, you will find the cause traces here (e.g., driver issues).
- System logs: Focus on services (daemons) and user-level events, such as system boot or network communication errors.
- Application logs: Usually located in subdirectories (e.g.,
/var/log/apache2or/var/log/mysql). This is where we look for errors specific to the running software.
Tip: If the system refuses to boot or behaves unstable, start with the journalctl -p err -b command, which will display errors from the current system boot.What’s next?
This is just the beginning. In upcoming episodes we will tackle advanced work with journalctl, log rotation automation using logrotate and remote event monitoring. If you want to deepen your knowledge about the person behind the system’s foundations, I recommend the article on the mind behind Linux – Linux Torvalds. See you in the next episode!
Sources
- https://help.ubuntu.com/community/LinuxLogFiles
- https://www.digitalocean.com/community/tutorials/how-to-view-and-configure-linux-logs-on-ubuntu-and-centos
- https://ubuntu.com/tutorials/basic-security#3-logging
- https://www.linuxjournal.com/content/linux-logging-basics
- https://www.loggly.com/ultimate-guide/linux-logging-basics/
- https://www.ubuntu.com/tutorial/install-ubuntu-desktop
- https://manpages.ubuntu.com/manpages/focal/en/man8/journalctl.8.html
- https://manpages.ubuntu.com/manpages/focal/en/man8/syslog-ng.8.html
Comments