Where Are System Logs Stored on Linux?
Linux logs under /var/log versus the systemd journal, with the key files for boot, auth and SSH failures.
Last updated
Classic Linux logs are plain text under /var/log. Systemd machines add a binary journal you read with journalctl instead of opening files.
Both usually run at once, with the journal forwarding into text files. Check the journal for services, /var/log for auth and boot history.
Where Linux stores this, by platform
/var/log
Key files: syslog (Debian/Ubuntu) or messages (RHEL) for general events, auth.log (or secure) for logins and sudo. Persistent journal copies sit under /var/log/journal when enabled.
Frequently asked questions
How do I read logs for one crashed service?
Query the journal filtered by unit name, newest first. That beats grepping syslog when the service name is known.
Where are failed SSH logins logged?
auth.log on Debian/Ubuntu, secure on RHEL, plus btmp for raw failed attempts. Rate limited bots fill these fast; that volume is normal on public servers.
Notice an outdated path? Let us know.