So if I run journalctl I see loads of kernel based commands but if I look at /var/log/syslog it is empty. I would like to setup swatch to monitor the journal but I ultimately need to know where the log is actually located. Am I missing something?

  • 1
    Maybe syslog service is stopped. Type sudo systemctl status syslog to see if it's running. If it's running, cat /etc/rsyslog.d/50-default.conf to see where it is saving log files.
    – Redbob
    Oct 12, 2017 at 13:09

1 Answer 1


Take a look at the /var/log directory.

Kernel messages can be found in /var/log/kern.log

You are welcome to take a look at the manuals or wikis:


As @Redbob stated, the location of the saved log files can be found in the /etc/rsyslog.d/50-default.conf file:

cat /etc/rsyslog.d/50-default.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.