How to View System Logs in Ubuntu?

Troubleshooting an Ubuntu system often requires analyzing system logs to identify errors, hardware faults, or application crashes. This guide provides a quick overview of the essential tools and commands needed to view and monitor these logs. You will learn how to use journald for systemd logs, navigate traditional log files in the /var/log directory, and utilize graphical tools for a more user-friendly troubleshooting experience.

Using journalctl for Systemd Logs

Modern versions of Ubuntu use systemd to manage system services, which records logs in a centralized, binary format managed by journald. The primary tool to access these logs is the journalctl command.

• View all logs: Running journalctl without any arguments displays the entire log history, starting from the oldest entry.
• Real-time monitoring: To stream logs in real time (similar to live tracking), use the follow flag: journalctl -f.
• Filter by service: If you need to troubleshoot a specific background service, like Apache or SSH, filter by the unit name: journalctl -u apache2.
• Filter by priority: To cut through the noise and see only errors or critical system failures, use: journalctl -p err -b.

Navigating the /var/log Directory

While journalctl handles systemd services, many traditional applications and system components still write plain-text files to the /var/log directory. You can navigate this directory using standard terminal commands like cd /var/log and view files using cat, less, grep, or tail.

• syslog: This is the most general log file, containing a massive variety of global system messages and activity logs.
• auth.log: Crucial for security troubleshooting, this file tracks user logins, authentication attempts, and sudo command usage.
• dmesg / kern.log: If you are dealing with hardware failures, driver issues, or boot problems, these logs capture kernel-level events.
• dpkg.log: When an update breaks your system, this log shows exactly which packages were recently installed, updated, or removed.

Graphical Log Viewers

If you prefer a graphical user interface (GUI) over the command line, Ubuntu includes a built-in application called Logs (or gnome-logs).

You can launch this application by opening your Ubuntu Activities overview and searching for “Logs”. The interface categorizes messages into sections such as “Important”, “Applications”, “System”, and “Hardware”. This allows you to click through events, search for specific keywords, and view detailed error reports without typing a single terminal command.