Debian Logging

Debian logs system events, service messages, and errors to help troubleshoot issues.

Primary log interface (all systemd-managed services):

journalctl

Follow logs in real-time:

journalctl -f

Last 50 lines:

journalctl -n 50

Logs for specific service:

journalctl -u nginx
journalctl -u ssh -n 100 -f

Filter by priority:

journalctl -p err           # errors and above
journalctl -p warning       # warnings and above

By time:

journalctl --since "2024-01-15"
journalctl --since "1 hour ago"
journalctl --until "2024-01-16"

Older services and kernel messages in /var/log/:

• syslog — general system logs
• auth — authentication attempts
• kern.log — kernel messages
• dmesg — kernel boot messages

View:

tail -f /var/log/syslog
tail -n 50 /var/log/auth.log
dmesg | tail

logrotate prevents logs from consuming all disk space. Configuration:

ls /etc/logrotate.d/

Example /etc/logrotate.d/nginx:

/var/log/nginx/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    create 0640 www-data adm
}

Check /var usage:

du -sh /var/log/
du -sh /var/log/*

Clean old journal logs (keep last 100 MB):

sudo journalctl --vacuum=size=100M
sudo journalctl --vacuum=time=1w

Clean specific service:

sudo journalctl -u nginx --vacuum=time=30d

By default, journal is volatile (lost on reboot). Make persistent:

sudo mkdir -p /var/log/journal
sudo systemctl restart systemd-journald

Now logs persist even after reboot.

Enable verbose logging in service files or apps. Check logs often—they're your best debugging tool.