Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know I can find logs in /var/log/, they contain powerful information, but I don't really use them often (on desktop or server).

Is there any good guide to learn how to make use of system logs on Ubuntu? Top things an user/basic admin needs to know?


  • check this log weekly
  • keep this file clean
  • set up log notification this way
  • when somethings wired happened, start here
  • use this tool to simplify your life
  • common command line usages
  • common uses of grep searching the logs

or any other tips to new users coming from Windows?

share|improve this question
up vote 2 down vote accepted

1st have a look at the answer by MaroCeppi here: Which logs should I pay attention to? It explains what some of the more common logs are used for. There is one more log named .xsession-errors in your home dir (and this records your login and has amongst others errors on loading indicators and laucher items), and often grows VERY large, especially if you never log out.

In general there is no need to check logs weekly. Security might be an exception but if that's the case your system probably is hosting a server (Apache for instance) and then it is more for seeing irregular access instead of errors. I tend to not look at them unless something is really broken.

Specifically targeting your questions:

use this tool to simplify your life

log file viewer is a good place to start:


set up log notification this way and when somethings wired happened, start here

It is a bit hard to answer this but I always start with dmesg or with the log related to the problem (no need to look in .xsession-errors when you get an error during booting ;) )

common command line usages and common uses of grep searching the logs

Commands that are rather useful:

cat will list the whole file.

grep will filter commands.

tail -f will keep a file active and you will see new notices show up in it when they happen. Rather helpful when tracking down what action you do results in a problem. (tail -100 will show the last 100 lines)

wc -l to count how many times some search happend.

more and less show the file too.

One example of this:

How many times did someone try to login on 'our' apacher server using IP address grep "GET /login.js" /var/log/httpd/access.log | grep | wc -l

share|improve this answer

Just after an "event" that you need to investigate, do a ls -rlt /var/log to get a reversed, time-ordered (by modification time) list of log files (most recently modified file last) to look at.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.