Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

For various reasons I can no longer access my graphical desktop, and can only login via a tty (Ctrl+Alt+F1 through F6 by default).

To help diagnose and solve my problem I need to look through the logs and maybe put some of the info into my question or forum thread.

How can I get this information?

share|improve this question

1 Answer 1

up vote 9 down vote accepted

First here is a list of some of the common log files and what they contain:

  • /var/log/messages : General message and system related stuff
  • /var/log/auth.log : Authenication logs.
  • /var/log/kern.log : Kernel logs.
  • /var/log/cron.log : Cron daemon logs.
  • /var/log/Xorg.0.log : Log for the X server.
  • ~/.xsession-errors : Logs related to the last X session (and the one before that, in xsession-errors.old)

After you've logged into the tty it's a good idea to move to the folder where the logs are located (usually /var/log). For this we use the cd command:

cd /var/log  

Now that we're in the folder where the logs are stored we use the ls command to see what logs exist:

ls -a

There will probably be quite a few, these instructions should apply to all of them.

Once you find a log you want to view, you can use the less command:

less kern.log  

Use the up/down arrow keys to browse through the file. When you're done, press Q to quit less. If you want to search the logs for a certain keyword you can use grep:

sudo grep "apparmor" kern.log 

Grep also accepts regular expressions. See man grep for more information.

This is all shiny and great you might say, but I don't have a single clue what I'm looking for, and I just need to give the log file to someone else to help me. We can do that too!

The best way to get the logs off your computer is to put them on external media, either a flash drive or SD card. Plug one in. Ubuntu should automatically mount it in /media so run

ls /media  

If you see the name of your flash drive/SD card there then you can continue. Otherwise you'll have to mount it manually. (don't worry! It isn't scary at all).

Once you have your drive mounted you can use the cp command to copy over the logs you need:

cp /var/log/kern.log /media/myFlashDrive/

When you're done unmount the drive:

sudo umount /media/myFlashDrive  

If you just need the output of a certain command see this question about saving terminal output to a file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.