View and filter system logs on Ubuntu

On an Ubuntu installation with rsyslog configured for traditional files, /var/log/syslog is a useful starting point. On a system using only the systemd journal, that file may not exist. Check the logging configuration before concluding that the host has stopped producing logs.

Read the text log efficiently

# Follow by filename across rotation.
sudo tail -F /var/log/syslog

# Show the most recent lines.
sudo tail -n 100 /var/log/syslog

# Search without loading the whole file into an editor.
sudo grep -i 'error' /var/log/syslog
sudo grep 'ssh' /var/log/syslog

# Browse and search interactively; press q to quit.
sudo less /var/log/syslog

tail -f is sufficient for a continuously growing file, while -F retries by filename after common rotation operations. Neither restores a log that has already been deleted. Older records may be in syslog.1 or compressed files such as syslog.2.gz; use zgrep for gzip-compressed archives.

Query the journal

journalctl -n 100
journalctl -f
journalctl -u nginx.service
journalctl --since '1 hour ago'
journalctl -p err
journalctl -p err..err

-p err includes error and more severe priorities. Use err..err for exactly error. A keyword search for the word “error” in a text file is different from filtering a structured priority. The journalctl reference documents those filters.

Access depends on the host's permissions. Use sudo where authorized, or grant appropriate group access. Traditional Ubuntu log files are often readable by adm; inspect actual ownership before changing group membership, and start a new login session after a membership change.

Know which source you are looking at

These are conventions, not mandatory files. RHEL-family hosts commonly use /var/log/messages instead of /var/log/syslog.

Traditional timestamps often use local time and omit an offset. Check timedatectl, the rsyslog output template, and the originating host's timezone; forwarded records may not use the receiver's clock. For journal comparisons, journalctl --utc makes the display explicit.

For several hosts, DataKit log collection can read the files that actually exist. If records are journal-only, choose a supported export or forwarding path before configuring a file collector.