How to view a service’s log, errors from the last hour, kernel messages and the previous boot, follow a log in real time and limit its size.
Contents
For almost any “why isn’t it working” question, the answer is in the log. On modern Linux the log is kept by systemd: messages from services, the kernel and the system itself are collected in one place and read with the journalctl command.
A service’s log
sudo journalctl -u nginx -n 50 --no-pager # the last 50 lines
sudo journalctl -u nginx -f # follow new lines-u is the service, and -f shows new lines as they appear; press Ctrl+C to exit. Without -n, the log opens in full from the very beginning: scroll with the space bar and the arrow keys, press G to go to the end, / to search and q to quit. -e opens the log at the end straight away.
To see several services at once, use -u nginx -u php8.4-fpm. systemctl list-units --type=service will show you the service names.
Choosing a time range
sudo journalctl --since "1 hour ago"
sudo journalctl --since today
sudo journalctl --since "2026-10-12 09:00" --until "2026-10-12 10:00"Times are in the server’s time zone, which timedatectl will show you.
Errors only
sudo journalctl -p err -b-p err shows errors and anything more serious; -p warning adds warnings. -b limits the output to the current boot.
The kernel and previous boots
sudo journalctl -k # kernel messages: disks, network, running out of memory
sudo journalctl --list-boots # list of boots
sudo journalctl -b -1 -e # the end of the previous bootThe last command helps you work out why the server rebooted: look at what was in the log just before it ended.
If --list-boots shows only one boot, the log is kept in memory and is lost on reboot. This is the default on AlmaLinux, where anything from before a reboot stays in /var/log/messages. To make the systemd journal persist on disk as well:
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journaldSearching for text
sudo journalctl -u ssh --since today | grep -i 'failed password'This shows who has been trying to guess your SSH password. The SSH service is called ssh on Ubuntu and Debian and sshd on AlmaLinux. If there are a lot of such lines, it is time to secure your server.
Files in /var/log
Many programs still write their logs to ordinary files:
| File | What it contains |
|---|---|
| /var/log/nginx/error.log, access.log | nginx errors and requests |
| /var/log/apache2/ — Ubuntu, Debian; /var/log/httpd/ — AlmaLinux | Apache |
| /var/log/syslog, /var/log/auth.log — Ubuntu | the general log and logins |
| /var/log/messages, /var/log/secure — AlmaLinux | the same on AlmaLinux |
| /var/log/apt/history.log, /var/log/dnf.log | what was installed and updated |
Debian 13 has no syslog or auth.log files. If the file you want is missing on your system too, look in journalctl: it holds the same information.
To follow a file, use sudo tail -f /var/log/nginx/error.log. Old logs are renamed and compressed by logrotate once a day or once a week (error.log.1, error.log.2.gz).
How much space the log takes
journalctl --disk-usage
sudo journalctl --vacuum-size=500M # keep the latest 500 MB
sudo journalctl --vacuum-time=30d # or the latest 30 daysThe journal itself takes no more than 10% of the disk and no more than 4 GB. To set a lower limit, see the article Disk full.
FreeBSD
FreeBSD has no systemd: the logs are ordinary files. The general log is /var/log/messages, and logins are in /var/log/auth.log. For more, see the FreeBSD reference.
Didn’t find the answer? Ask our support team — we’ll help.