Security and VPN

Linux Server Logs: journalctl, /var/log and tail -f

26 May 2026 By Olga Naumova

There are two ways to read server logs: journalctl (the systemd journal, where most services write) and the files in /var/log. A live stream is easiest to follow with tail -f, and errors are found with grep. Below are the commands you will use every day.

Where the logs live

journald — the centralised systemd journal, read through journalctl.
/var/log/ — text files of individual services (nginx, mysql, mail).
dmesg — kernel messages.

journalctl: the main tool

Show the whole journal (from the end, scrollable):

journalctl -e

A live stream

journalctl -f

The equivalent of tail -f, but for the entire systemd journal. Press Ctrl+C to stop.

Logs of a specific service

journalctl -u nginx
journalctl -u ssh -f

Filtering by time

journalctl --since "2026-05-26 09:00" --until "2026-05-26 10:00"
journalctl --since "1 hour ago"
journalctl --since today

Errors only

By priority level (0 is emergency, 3 is error):

journalctl -p err -b

-b limits the output to the current boot. For the previous boot:

journalctl -b -1

Kernel logs

journalctl -k

The last N lines

journalctl -u nginx -n 50

Files in /var/log

Useful files (they vary by distribution):

File	What it holds
`/var/log/syslog`	General system events (Debian/Ubuntu)
`/var/log/auth.log`	Authentication and SSH logins
`/var/log/nginx/error.log`	Web server errors
`/var/log/nginx/access.log`	Requests to the site
`/var/log/mysql/error.log`	MySQL/MariaDB errors
`/var/log/dmesg`	Kernel messages from boot

tail, head and less

Follow a file live:

tail -f /var/log/nginx/access.log

The last 100 lines:

tail -n 100 /var/log/nginx/error.log

Page through it with search (press / to search inside):

less /var/log/syslog

Follow several files at once:

tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Searching logs with grep

Find errors:

grep -i "error" /var/log/nginx/error.log

Show context (3 lines before and after):

grep -i -C 3 "segfault" /var/log/syslog

Count failed SSH logins:

grep "Failed password" /var/log/auth.log | wc -l

A live stream with a filter:

tail -f /var/log/nginx/access.log | grep " 500 "

Analysing web logs

Top IP addresses by number of requests:

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head

Most requested URLs:

awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head

Log size and rotation

The size of the systemd journal:

journalctl --disk-usage

Clear old entries, keeping the last 200 MB or 7 days:

journalctl --vacuum-size=200M
journalctl --vacuum-time=7d

Text logs are rotated by logrotate — its settings live in /etc/logrotate.d/.

Making the journal persistent

By default some systems keep the journal in memory only and lose it on reboot. Enable persistent storage:

mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald

Now journalctl -b -1 shows logs from previous boots, which is invaluable when investigating unexpected restarts.

Combining filters

journalctl combines filters. Errors from one service in the past hour:

journalctl -u nginx -p err --since "1 hour ago"

Logs of a specific process (PID):

journalctl _PID=1234

By executable:

journalctl /usr/sbin/sshd

Output formats for parsing

JSON is convenient for feeding logs into scripts:

journalctl -u nginx -o json-pretty --since today

Compact output without wrapping and with priorities:

journalctl -o short-precise -p warning

Watching errors in real time

Build an “alarm panel” — a live stream of errors from every service:

journalctl -f -p err

Leave it running in a separate tmux/screen session so problems show up as they happen. It is a simple substitute for a dashboard when you need to understand server behaviour quickly.

Frequently asked questions

Why is /var/log/auth.log empty? On journald-based systems logs are not always duplicated into files. Use journalctl -u ssh instead.

How do I see the logs of a service that crashed? journalctl -u service_name -n 100 --no-pager shows the last lines before the crash.

The logs take up too much space — what now? Trim the journal with journalctl --vacuum-size and set SystemMaxUse in /etc/systemd/journald.conf.

How do I export logs to a file? journalctl -u nginx --since today > nginx-today.log.

What is the difference between tail -f and journalctl -f? tail -f follows one file, while journalctl -f follows the whole systemd journal with filters by service and priority.

Being comfortable with logs makes operations far easier. Host your project on a VPS plan or a VPS for security and VPN. Monitoring and incident analysis can be taken over by Server administration.

Share: