General Logging

General system logs combine routine notices, warnings, and errors from multiple sources. They are useful starting points, but their filenames and contents are routing-policy choices rather than universal Linux guarantees.

Finding the Relevant Source

Depending on the distribution and configuration, general messages may appear in /var/log/syslog, /var/log/messages, the systemd journal, or more than one destination. Begin by identifying the host and incident interval, then inspect available sources:

$ ls -lh /var/log
$ journalctl --since '2026-08-31 09:00' --until '2026-08-31 09:15'

Application logs may live in their own subdirectories or an external service. Authentication, audit, package, database, and web-server records can be intentionally separated from the general stream.

CheckWhy should you not assume /var/log/messages exists on every Linux host?

Inspecting Text Logs

Use less for controlled navigation and tail for the newest records:

$ sudo less /var/log/syslog
$ sudo tail -n 100 /var/log/messages

Follow newly appended lines during a bounded reproduction with tail -F FILE. -F retries when a file is replaced during rotation, unlike a simple snapshot. Stop following with Ctrl-C and avoid leaving broad privileged sessions open.

CheckWhat is tail -F useful for during a controlled reproduction?

Filtering Without Losing Context

Search a bounded file or journal interval rather than piping an unbounded live stream immediately:

$ grep -n -C 3 'connection refused' /var/log/example.log
$ journalctl -u example.service --since '10 minutes ago' --grep='connection refused'

Case, wording, rate limits, and localization can make a literal search incomplete. Record both successful and failed events, and keep surrounding lines because the cause may precede the visible error.

CheckWhy include lines around a matching error?

Including Rotated and Archived Logs

An incident may cross a rotation boundary. Active files, numbered archives, and compressed files can contain different parts of the same sequence. Tools such as zgrep and zless read gzip-compressed archives:

$ sudo zgrep -n 'connection refused' /var/log/example.log*.gz

Order results by actual timestamps, not suffix alone. Before copying evidence, preserve metadata and restrict access because logs can contain personal data or credentials.

CheckWhat should you check when an incident spans a log rotation?

Summary

You can now investigate general logs across files, journals, and rotation boundaries.

Discover destinations instead of assuming a universal filename.
Read a bounded interval and follow only during reproduction.
Keep temporal context around matching records.
Include rotated archives and protect sensitive evidence.

Practice

In the practice terminal, run: ls -lh /var/log tail -n 100 /var/log/syslog The first lists available log files and their sizes. The second prints the newest lines of the general log (if /var/log/syslog is missing here, tail any file you saw in the listing instead).

Log destinations are routing choices - never assume one filename.