How to View and Search System Logs

Using journalctl (systemd logs)

journalctl              # All logs (oldest first)
journalctl -r           # Newest first
journalctl -f           # Follow live (like tail -f)
journalctl -n 100       # Last 100 lines
journalctl -u nginx     # Logs for a specific service
journalctl -u nginx -f  # Follow nginx logs live
journalctl --since "1 hour ago"
journalctl --since "2026-01-01" --until "2026-01-02"
journalctl -p err       # Only errors (crit, err, warning, info, debug)

Key Log Files

• /var/log/syslog — general system messages
• /var/log/auth.log — SSH logins, sudo usage, authentication events
• /var/log/nginx/access.log — all web requests
• /var/log/nginx/error.log — Nginx errors
• /var/log/mysql/error.log — MySQL/MariaDB errors
• /var/log/fail2ban.log — Fail2Ban ban events

Searching Logs with grep

grep "Failed password" /var/log/auth.log
grep "404" /var/log/nginx/access.log | wc -l
grep -i "error" /var/log/syslog | tail -50

Live Log Tailing

tail -f /var/log/nginx/access.log
tail -f /var/log/nginx/error.log

Reading Compressed Logs

zcat /var/log/syslog.2.gz
zgrep "error" /var/log/syslog.2.gz