> For the complete documentation index, see [llms.txt](https://chxmxii.gitbook.io/rhcsa/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chxmxii.gitbook.io/rhcsa/system-logging/system-logging.md).

# System logging

Learn how logging in Linux is done and how you can manage logs in Linux.

Most services used on a Linux server write information to log files. This information can be written to different destinations, and there are multiple solutions to find the relevant information in system logs. Many different approaches can be used by services to write log information and the most common is:\
&#x20; -> <mark style="color:blue;">**Direct Writting :**</mark> exp : **logger -p kern.err** "hello"\
&#x20; **->**<mark style="color:blue;">**rsyslogd:**</mark> rsyslogd is the enhancement of syslogd, a service that takes care of managing centralized log files. Syslogd has been around for a long time. \
&#x20; **->**<mark style="color:blue;">**Journald:**</mark> With the introduction of Systemd, the journald log service systemd journald has been introduced also. This service is tightly integrated with Systemd, which allows administrators to read detailed information from the journal while monitoring service status using the systemctl status command.

You can find the all global system activities within /var/log/syslog, while the security related events are stored in /var/log/audit.log...etc\
Here is a list of **which** activity and **where** to find its logs.\
![](https://1665942818-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLJsJMnBMMxD0FyBYwnWo%2Fuploads%2FRg950iAeWXm6HF3JULz3%2Fimage.png?alt=media\&token=afde814e-a3cb-4f0d-9fcf-c9c88f20c6d5)&#x20;

## **Systemd-journald :**&#x20;

I've already explained this, let me show you some useful commands : \
&#x20;-> <mark style="color:blue;">**journalctl**</mark> -u <mark style="color:blue;">\<service-name> :</mark> see logs about a specific service.\
&#x20;-><mark style="color:blue;">**journalctl**</mark> <mark style="color:red;">**-f**</mark> : follow the journal until you stop it.\
&#x20;-> <mark style="color:blue;">journalctlt</mark> -f <mark style="color:yellow;">--no-pager</mark> -p info <mark style="color:green;">--since yesterday</mark> -o verbose <mark style="color:red;">\_SYSTEMD\_UNIT=sshd.service</mark>

Usually the journald is not persistent, so to make it one, then you will have to modify <mark style="color:blue;">**/etc/systemd/journald.conf**</mark> \
to set the storage permanently follow my steps : \
&#x20;-> vim /etc/systemd/journald.conf \
&#x20;-> add this line "storage = persistent" then save and quit\
&#x20;->  systemctl restart systemd-journald&#x20;

{% hint style="info" %}
**NOTE :** storage = persistent will create /var/log/journal, while storage = auto will store the loggs if /var/log/journal exist, so make sure to make that directory if you've set storage = auto\
**Consult man for more info.**
{% endhint %}

## rsyslogd :&#x20;

as we've said before, rsyslog is the service that takes care of managing centralized log files. To make sure that the information you need is logged in a location where you want to find it, then you can configure rsyslog service through /etc/rsyslog.conf file. there is different section inside this file that allow you to specify where and how information should be written.\ <mark style="color:blue;">**##Modules##**</mark>**&#x20;->** rsyslog is modular, as they are included to enhance the supported featuers.\ <mark style="color:blue;">**##Global DIRECTIVES##**</mark>**&#x20;->** used to specify global parameters, such as the location where auxiliary files are written or the default timestamp format.\ <mark style="color:blue;">**##RULES##**</mark> ->  most important part, used to specify what information should be logged to which destiniation.\
\
rsyslog service uses facility, priority and log destination.  \ <mark style="color:yellow;">facility</mark> is the category, while <mark style="color:red;">priority</mark> and <mark style="color:blue;">log destination</mark> is define the location.\
Here is a quick example : <mark style="color:yellow;"><mark style="color:red;">**l**<mark style="color:red;"></mark><mark style="color:yellow;">ocal1.</mark><mark style="color:red;">e</mark><mark style="color:red;">**rror**</mark><mark style="color:red;">**&#x20;**</mark><mark style="color:red;"><mark style="color:blue;">**/**<mark style="color:blue;"></mark><mark style="color:blue;">**var/log/httpd-error.log**</mark>\
\
![](https://1665942818-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLJsJMnBMMxD0FyBYwnWo%2Fuploads%2FnY5A1NThjiClb8usGngk%2Fimage.png?alt=media\&token=e4a44a66-f0b2-4fbb-9cf6-7eed01e15df2)

## logrotate :

log-rotation is used to prevent syslog messages filling your system. logrotae allow you to delete log files if they reached any condition.\
You can find the logrotate conf file within /etc/logrotate.conf&#x20;

{% hint style="info" %}
Consult man logrotate for more help.
{% endhint %}