Master Linux System Logs: Command-Line Tools, Log Files, and GUI Viewers

1. View System Logs with Command-Line Tools

journalctl is the client for the systemd journal. Running journalctl lists all entries, newest first. Use journalctl -n 50 to show the latest 50 lines, or journalctl -u nginx.service to filter logs for a specific unit such as nginx.service.

dmesg displays the kernel ring buffer. Execute dmesg to see all kernel messages. To limit output, use dmesg -n 50. You can pipe the result to grep for keyword filtering, e.g., dmesg | grep error.

2. Inspect System Log Files Directly

Common log files reside under /var/log: /var/log/messages – all system messages, including kernel, applications, and services. /var/log/syslog – similar to messages but generated by the syslog daemon. /var/log/auth.log – authentication and authorization events (logins, sudo, etc.). /var/log/dmesg – kernel ring‑buffer content, mirroring the output of the dmesg command.

To view them, use

cat /var/log/messages
cat /var/log/syslog
cat /var/log/auth.log
cat /var/log/dmesg

. For the most recent lines, employ tail -n 50 /var/log/messages (replace the file name as needed).

3. Use Graphical Log Management Tools

Several GUI applications simplify log inspection:

GNOME Logs – the official log viewer for the GNOME desktop, accessible from the applications menu.

KSystemLog – KDE’s counterpart, providing a similar interface and installable via the software center.

Logwatch – a powerful command‑line utility that parses logs and generates summary reports. Install it with sudo apt-get install logwatch.

Regardless of the method—command‑line, direct file access, or graphical viewer—system logs are essential for diagnosing issues and monitoring Linux performance.