Linux Log Files You Should Know About

Linux generates lots of log files, especially web servers. In this article, you will learn which ones are important as well as a simple way to grab and watch them all.

PHP Errors

Ubuntu: /var/log/apache2/error.logCentOS: /var/log/apache/php.errors

This where all your PHP errors go. If the web site is not behaving properly, chances are, it is a code glitch, and you can find it here. You can offer to fix it for the customer or not. A WordPress plugin is very commonly the culprit.

System Events

Ubuntu: /var/log/syslogCentOS: /var/log/messages

Random system events go here. If a Cron job was executed, you would find it here. Utilities with debug statements go here. PHP can write here. It is essentially the go-to location for all things notable that aren’t really errors.

PostgreSQL

Ubuntu and CentOS: /usr/local/pgsql/data/postgresql.log

I have always installed PostgreSQL from source, and when you do, this is where the log file ends up. You can invoke the find or locate command to find the .conf file and see if the log is in another location:

root@server~# locate *.conf | grep 'postg'/usr/local/pgsql/data/postgresql.confroot@server~# cat /usr/local/pgsql/data/postgresql.conf | grep 'log_filename ='log_filename = 'postgresql.log'

The PostgreSQL has all the postgres errors or anything else that may be enabled for logging. If a user is having database problems. This is a good place to find them.

MySQL

Ubuntu: /var/log/mysql.logCentOS: /var/log/mysqld.log

 Same as PostgreSQL, but for MySQL. If your user has a MySQL database, then look here.

“tail -f” is a useful command you can do to look and follow various files:

tail -f /var/log/syslog /var/log/apache2/error.log

That will look at the last 5 lines and start following all the listed files. Then you can recreate the error and see what is happening in real time. Very handy.

Suppose you want to look at it later? Then tar them all up.

tar -cvf logfiles.tar /var/log/syslog /var/log/apache2/error.log

You may want to gzip and encrypt them too.

gzip logfiles.tarmcrypt -a rijndael-256 logfiles.tar.gz -k yourpassword

Now copy them over to your other computer for analysis. SFTP is a good method to use.

Linux generates so many log files that it often gzips old logs. You will find the old logs in the same directory as the .log. The old logs will be named something like syslog.1 or syslog.1.gz depending on the age of the log. If the error is frequent, the the main one will usually do. However, if needed, the old logs are available too.

There are many log files. The ones listed above will go far in finding the problem for you.