# Debian Logging

Debian logs system events, service messages, and errors to help troubleshoot issues.

## systemd Journal

Primary log interface (all systemd-managed services):

```bash
journalctl
```

Follow logs in real-time:

```bash
journalctl -f
```

Last 50 lines:

```bash
journalctl -n 50
```

Logs for specific service:

```bash
journalctl -u nginx
journalctl -u ssh -n 100 -f
```

Filter by priority:

```bash
journalctl -p err           # errors and above
journalctl -p warning       # warnings and above
```

By time:

```bash
journalctl --since "2024-01-15"
journalctl --since "1 hour ago"
journalctl --until "2024-01-16"
```

## Traditional Logs

Older services and kernel messages in `/var/log/`:

- `syslog` — general system logs
- `auth` — authentication attempts
- `kern.log` — kernel messages
- `dmesg` — kernel boot messages

View:

```bash
tail -f /var/log/syslog
tail -n 50 /var/log/auth.log
dmesg | tail
```

## Log Rotation

`logrotate` prevents logs from consuming all disk space. Configuration:

```bash
ls /etc/logrotate.d/
```

Example `/etc/logrotate.d/nginx`:

```
/var/log/nginx/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    create 0640 www-data adm
}
```

## Managing Log Disk Space

Check `/var` usage:

```bash
du -sh /var/log/
du -sh /var/log/*
```

Clean old journal logs (keep last 100 MB):

```bash
sudo journalctl --vacuum=size=100M
sudo journalctl --vacuum=time=1w
```

Clean specific service:

```bash
sudo journalctl -u nginx --vacuum=time=30d
```

## Persistent vs. Volatile

By default, journal is volatile (lost on reboot). Make persistent:

```bash
sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald
```

Now logs persist even after reboot.

## Debugging

Enable verbose logging in service files or apps. Check logs often—they're your best debugging tool.