Chapter 2. Troubleshooting problems by using log files

Investigate system problems by examining journal entries and traditional log files. Filtering logs by time, service, and priority helps you quickly narrow down the root cause.

The rsyslogd and journald system services handle syslog messages. These services capture, process, and store security-relevant system events.

The following services handle syslog messages:

Locate where system logging services store recorded syslog messages. Most log files are kept in the /var/log/ directory, often organized logically into subdirectories based on the application.

The following subdirectories under the /var/log directory store syslog messages:

You can view and manage log files by using the Journal, which is a component of systemd. It addresses problems connected with traditional logging, is closely integrated with the rest of the system, and supports various logging technologies and access management for the log files.

You can use the journalctl command to view messages in the system journal, for example:

$ journalctl -b | grep kvm
May 15 11:31:41 localhost.localdomain kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00
May 15 11:31:41 localhost.localdomain kernel: kvm-clock: cpu 0, msr 76401001, primary cpu clock