General Logging

General system logs combine routine notices, warnings, and errors from multiple sources. They are useful starting points, but their filenames and contents are routing-policy choices rather than universal Linux guarantees.

Finding the Relevant Source

Depending on the distribution and configuration, general messages may appear in /var/log/syslog, /var/log/messages, the systemd journal, or more than one destination. Begin by identifying the host and incident interval, then inspect available sources:

$ ls -lh /var/log
$ journalctl --since '2026-08-31 09:00' --until '2026-08-31 09:15'

Application logs may live in their own subdirectories or an external service. Authentication, audit, package, database, and web-server records can be intentionally separated from the general stream.

CheckWhy should you not assume /var/log/messages exists on every Linux host?

General log destinations depend on local collectors and routing policy. Linux permits only one log file on each disk. The path is reserved exclusively for user documents.

Inspecting Text Logs

Use less for controlled navigation and tail for the newest records:

$ sudo less /var/log/syslog
$ sudo tail -n 100 /var/log/messages

Follow newly appended lines during a bounded reproduction with tail -F FILE. -F retries when a file is replaced during rotation, unlike a simple snapshot. Stop following with Ctrl-C and avoid leaving broad privileged sessions open.

CheckWhat is tail -F useful for during a controlled reproduction?

Following a named file across common rotation replacement. Changing every log severity to debug. Decrypting compressed archives without another program.

Filtering Without Losing Context

Search a bounded file or journal interval rather than piping an unbounded live stream immediately:

$ grep -n -C 3 'connection refused' /var/log/example.log
$ journalctl -u example.service --since '10 minutes ago' --grep='connection refused'

Case, wording, rate limits, and localization can make a literal search incomplete. Record both successful and failed events, and keep surrounding lines because the cause may precede the visible error.

CheckWhy include lines around a matching error?

The preceding event may explain the later failure. Context guarantees the first match is the root cause. It changes the service configuration automatically.

Including Rotated and Archived Logs

An incident may cross a rotation boundary. Active files, numbered archives, and compressed files can contain different parts of the same sequence. Tools such as zgrep and zless read gzip-compressed archives:

$ sudo zgrep -n 'connection refused' /var/log/example.log*.gz

Order results by actual timestamps, not suffix alone. Before copying evidence, preserve metadata and restrict access because logs can contain personal data or credentials.

CheckWhat should you check when an incident spans a log rotation?

Only the newly created empty active file. Active and archived logs ordered by event time. Only filenames, regardless of record timestamps.

Summary

You can now investigate general logs across files, journals, and rotation boundaries.

1. Discover destinations instead of assuming a universal filename.
2. Read a bounded interval and follow only during reproduction.
3. Keep temporal context around matching records.
4. Include rotated archives and protect sensitive evidence.