How to check system logs in Ubuntu

To troubleshoot issues or monitor system activity in Ubuntu, checking logs is one of the most essential skills. Most logs are stored in plain text under the /var/log/ directory, and you can access them using standard command-line tools.

Viewing Logs with journalctl

Ubuntu uses systemd, so journalctl is the modern way to view system logs.

To see all logs (might be huge):

journalctl

See the latest logs at the bottom:

journalctl -xe

Show logs since the last boot:

journalctl -b

Filter logs by a specific service (e.g., SSH):

journalctl -u ssh

Check logs within a time range:

journalctl --since "2025-06-21 12:00" --until "2025-06-21 14:00"

Follow logs in real time (like tail -f):

journalctl -f

Accessing Traditional Log Files

Ubuntu also stores older-style log files in /var/log.

View system logs:

cat /var/log/syslog

Or use less for easier navigation:

less /var/log/syslog

For authentication-related logs:

less /var/log/auth.log

Check kernel logs:

dmesg

Or filtered with less:

dmesg | less

ls /var/log/apache2/

cat /var/log/apache2/error.log