So if I run journalctl I see loads of kernel based commands but if I look at /var/log/syslog it is empty. I would like to setup swatch to monitor the journal but I ultimately need to know where the log is actually located. Am I missing something?
1 Answer
Take a look at the /var/log directory.
Kernel messages can be found in /var/log/kern.log
You are welcome to take a look at the manuals or wikis:
https://help.ubuntu.com/community/LinuxLogFiles
As @Redbob stated, the location of the saved log files can be found in the /etc/rsyslog.d/50-default.conf file:
cat /etc/rsyslog.d/50-default.conf
sudo systemctl status syslogto see if it's running. If it's running,cat /etc/rsyslog.d/50-default.confto see where it is saving log files.