Online presence is more than just something these days. People do have ideas, and they are turning them into businesses, portfolios, services, and so on. To power these websites up, the servers have to be up and running fine. But things do go wrong, and thus you might be asked to check the server logs to fix the issues yourselves. Here is TechDecipher’s offering on how you can check server logs on various Linux distributions.
In Today’s post, we are going to check why checking server logs is necessary, brief about logs and how to check logs on Linux distributions, without further due, let’s begin.
Why is checking logs necessary?
Let’s take this whole matter through the end user’s eyes. The user requires a website for their business needs. The first thing user would do is they would sign up as a freelancer developer and things begin. After that, they start to encounter some issues, such as accessibility in certain regions or certain devices not loading the website, and so on. You would contact the developer about this issue, and then the developer might contact their server provider about the same.
Sometimes the sites are hosted on a shared platform, so the hosting provider would consider the request and might share the log details. However, when you or your developer has their own server, then the situation differs. In that case, the service provider might refuse to provide support due to the fact that your server already has root permissions. This is enough to cause disputes, the developer is burdened with the client’s request. Server providers or hosting providers would always have some limits for scope of support for legal and obvious reasons.
To figure out the actual reasons for the issue, one must know how to check the logs. No matter if it’s a website or an API or it is an application, checking logs would help you solve the issues in no longer and gain client trust. With you able to review logs and manage things, you may gain more clients and a good opportunity to extend web and server management. It’s not necessary that only server admins handle servers these days, and that’s why knowing these skills is an added bonus.
Brief about logs
In Linux distributions, the default directory for logs is /var/log. All important logs for your server are located in var/log. You can change this location but that needs to be done in the configuration of your server. The log details for respective components/services are as follows.
1) Boot logs
Boot logs are the log file that contains all system actions while it’s booting until the system or machine is up and running. This log file may contain the boot sequence and some events if they have gone wrong and things over the course of booting up.
2) Chronyd logs
This chrony log contains the statistical information on your Linux server. This also contains NTP services that sync the time hence checking logs would be helpful in case when things go wrong.
4) Cron
This file contains the cron-related logs. This can help you understand whether the cron is being performed or delayed.
5) Maillog
These logs would help you figure out the emails and information about sending and receiving of emails.
6) Secure
Secure logs are a very helpful log for checking login records. It would help you figure out all the login users and ssh login records as well. You can use it to verify if anyone was backdooring.
7) Messages
This log stores all global information such as hardware, and software info. It indeed comes in important logs in the Linux env. For Debian-based servers like Ubuntu and Mint the path to log in is /var/log/Syslog and for RHEL based like centOS and Alma its /var/log/messages.
8) MTA logs
These logs are actually for the mail transfer agent which is used in the server. This helps in understanding the actual emails whether they are going, failing and so in a more profound way. Most of the time, it would be Exim. The full log name would be exim_mainlog. Apart from Exim, there are many others like Postfix that need to be installed.
Then there are Apache logs, and MySQL logs of them you can find them in the var/log directory and explore what might be wrong.
How logging works on modern Linux systems
Many older Linux tutorials tell users to search only inside `/var/log`. That directory is still important, but it is no longer the complete picture now.
Most current Linux distributions use `systemd-journald`. It collects messages from the kernel, system services, standard output, and other sources. You read those entries with the `journalctl` command.
Some distributions also run a traditional syslog service such as Rsyslog. It can write journal messages to text files under `/var/log`. Applications such as Apache, Nginx, MySQL, and cPanel can also write their own files.
Therefore, a log may be available in one or more of these places:
- The systemd journal, viewed with `journalctl`
- General text logs under `/var/log`
- An application’s own log directory
- A hosting control panel such as cPanel
- A container runtime or centralized logging service
The exact location depends on the operating system, installed packages, and service configuration
How to check logs?
1) Shared hosting with cpanel
Being in the industry, hosting with cpanel is a wide choice of people these days. The majority of end users opt out shared hosting model with cpanel as the control panel. The reason is simple, cpanel is very user-friendly to manage sites. If you do not have root permission for your cpanel account then checking logs should be done by following ways. Login to your cPanel account using the hosting IP along with port number 2083. Suppose your hosting IP is 323.23.233.3 you would need to use it as 323.23.233.3:2083 in the browser to access your cPanel. You may ask your hosting IP to your hosting provider if you are not sure about IP and user credentials.
When you are in, navigate to sections like Errors, Error Pages, and Raw Access to figure out if anything is wrong with the site or account. You would not be able to run sudo commands in the shared hosting cPanel account since it is managed by your hosting provider. So you would be able to check the basic functions the cPanel provides.
2) Servers
Let’s have a look at how to check logs in the Linux distributions. With the server, you would need extra effort to review the logs. You can make use of the command line interface to collect valuable information about the issue. Not a while ago we covered how to access servers with different approaches which you can check here. Once you are in, change the directory to /var/log to see what types of log files are present and then you can cat them to preview and use various variations to gain the best conclusion. Follow the below commands according to your need, and read them carefully. You may as well google some of the logs which would help you how to troubleshoot them.
cPanel
cat /usr/local/cpanel/logs/access_log | more
cat /usr/local/cpanel/logs/access_log | head -3
cat /usr/local/cpanel/logs/access_log | tail -3
grep username /usr/local/cpanel/logs/error_log | tail -3
Apache, httpd, and Nginx logs
cat /var/log/apache2/error_log | grep username tail -2
cat /var/log/apache2/error_log | grep username head -2
grep ModSecurity /usr/local/apache/logs/error_log
grep ModSecurity /usr/local/apache/logs/error_log | grep -i cp-user
grep ModSecurity /usr/local/apache/logs/error_log | grep -i your-website.com
sudo tail -n 100 /var/log/apache2/error.log
sudo tail -n 100 /var/log/httpd/error_log
sudo tail -n 100 /var/log/nginx/error.log
sudo tail -n 100 /var/log/nginx/access.log
sudo journalctl -u nginx –since “30 minutes ago” –no-pager
Replace your cp-user and your-website.com with your actual cpanel user and your website’s domain name.
Mail log
cat /var/log/maillog | tail -2
cPHulk activity and errors
sudo tail -n 100 /usr/local/cpanel/logs/cphulkd.log
sudo tail -n 100 /usr/local/cpanel/logs/cphulkd_errors.log
Firewalld
For firewalld, use its service journal:
For UFW, first check whether logging is enabled, then inspect the configured log or journal:
sudo journalctl -k –since today –no-pager | grep -F — ‘[UFW ‘
sudo tail -n 100 /var/log/ufw.log
Secure
cat /var/log/secure | tail -10
Exim and mail logs
sudo grep -F — ‘user@example.com’ /var/log/mail.log | tail -n 50
sudo grep -F — ‘user@example.com’ /var/log/maillog | tail -n 50
sudo grep -F — ‘user@example.com’ /var/log/exim_mainlog | tail -n 50
sudo tail -n 100 /var/log/exim_paniclog
An email can have several recipients and delivery stages. Use its Exim message ID or Postfix queue ID to correlate all related entries instead of relying only on the address.
Dmesg
MySQL and MariaDB
You would need to verify where your Database service is storing logs, its located in mycnf
mysql -e “show variables like ‘%log%’;”
in my case it is
| log_error | /var/lib/mysql/199-193-7-132.cprapid.com.err
so I caught the file
cat /var/lib/mysql/199-193-7-132.cprapid.com.err | tail -10
You may check this cpanel documentation for more here.
MariaDB
Also check the appropriate service journal for mariaDB:
sudo journalctl -u mysqld –since “30 minutes ago” –no-pager
sudo journalctl -u mariadb –since “30 minutes ago” –no-pager
Authentication and SSH logs
Ubuntu and Debian commonly record authentication events in `/var/log/auth.log`. RHEL, Rocky Linux, and AlmaLinux commonly use `/var/log/secure` when file-based logging is enabled.
sudo tail -n 100 /var/log/secure
sudo journalctl -u ssh –since today –no-pager
sudo journalctl -u sshd –since today –no-pager
The service is often named `ssh` on Ubuntu and `sshd` on RHEL-family systems.
Filter failed login messages:
Do not assume that every failed login means the server was compromised. Internet-facing SSH servers commonly receive automated login attempts. Investigate successful logins, unexpected source addresses, new accounts, and configuration changes together.
Cron and scheduled-task logs
On Ubuntu and Debian, cron messages may appear in the system journal or `/var/log/syslog`. On RHEL-family distributions, they may appear in the journal or /var/log/cron.
sudo journalctl -u crond –since today –no-pager
sudo grep -F — ‘CRON’ /var/log/syslog | tail -n 50
sudo tail -n 100 /var/log/cron
Use the applicable service and file for your distribution. A cron entry proves that cron launched a command; the script should also capture its own output and errors if you need to confirm that every step completed.
Note:Â Some commands may differ due to it being RHEL-based, and if you wish to check the differences between commands in Debian-based OS like Ubuntu, check the article here. This blog currently has limited commands to begin with, however, we will update it from time to time to give you an ultimate log checking experience to help you troubleshoot your issues.
Frequently Asked Questions (FAQ)
Are all Linux logs stored in `/var/log`?
What is the difference between an access log and an error log?
Can I check system logs from shared cPanel hosting?
Is it safe to share a log publicly?
Conclusion
In the blog, we have checked some basic commands to help you get started. Though server administration is a vast subject, having a basic command idea is enough to understand the issues. This concludes with how to check logs in the Linux distributions. Which command helps you fix issues? do let us know in the comments section below. If you need any help or have any suggestions to make, then do reach us via the contact page here. Happy Global Beatles Day!
