When your system is running smoothly, take some time to learn and understand the content of various log files, which will help you when there is a crisis and you have to look though the log files to identify the issue.
/var/log/messages– Contains global system messages, including the messages that are logged during system startup. There are several things that are logged in /var/log/messages including mail, cron, daemon, kern, auth, etc.
/var/log/dmesg– Contains kernel ring buffer information. When the system boots up, it prints number of messages on the screen that displays information about the hardware devices that the kernel detects during boot process. These messages are available in kernel ring buffer and whenever the new message comes the old message gets overwritten. You can also view the content of this file using the dmesg command.
/var/log/lastlog– Displays the recent login information for all the users. This is not an ascii file. You should use lastlog command to view the content of this file.
/var/log/secure– Contains information related to authentication and authorization privileges. For example, sshd logs all the messages here, including unsuccessful login.
/var/log/wtmp or /var/log/utmp– Contains login records. Using wtmp you can find out who is logged into the system. who command uses this file to display the information.
/var/log/faillog– Contains user failed login attemps. Use faillog command to display the content of this file.
/var/log/conman/– Log files for ConMan client. conman connects remote consoles that are managed by conmand daemon.
/var/log/prelink/– prelink program modifies shared libraries and linked binaries to speed up the startup process.
/var/log/prelink/prelink.log contains the information about the .so file that was modified by the prelink.
/var/log/audit/– Contains logs information stored by the Linux audit daemon (auditd).
/var/log/setroubleshoot/– SELinux uses setroubleshootd (SE Trouble Shoot Daemon) to notify about issues in the security context of files, and logs those information in this log file.
/var/log/samba/– Contains log information stored by samba, which is used to connect Windows to Linux.
/var/log/sa/– Contains the daily sar files that are collected by the sysstat package.
/var/log/sssd/– Use by system security services daemon that manage access to remote directories and authentication mechanisms.
Viewing huge log files for trouble shooting is a mundane routine tasks for sysadmins and programmers. In this article, let us review how to effectively view and manipulate huge log files using 10 awesome examples.
This example shows how to ignore the last N lines, and show only the remaining lines from the top of file. The following example will display all the lines of the /var/log/secure except the last 250 lines.
This example shows how to ignore the first N-1 lines and show only the remaining of the lines. The following example ignores the 1st four lines of the /etc/xinetd.conf, which contains only the comments.
This is probably one of the most used command by sysadmins.To view a growing log file and see only the newer contents use tail -f as shown below.The following example shows the content of the /var/log/syslog command in real-time.