Find MySQL error, slow-query, and general logs

MySQL log locations vary by package, container image, and configuration. Ask the running server before looking for a familiar filename.

Read the active settings

SHOW VARIABLES LIKE 'log_error';
SHOW VARIABLES LIKE 'slow_query_log';
SHOW VARIABLES LIKE 'slow_query_log_file';
SHOW VARIABLES LIKE 'general_log';
SHOW VARIABLES LIKE 'general_log_file';
SHOW VARIABLES LIKE 'log_output';
SHOW VARIABLES LIKE 'datadir';

A configured slow-log filename does not mean the log is enabled. log_output must include FILE for that file to receive slow or general log records. If it includes TABLE, query mysql.slow_log or mysql.general_log with suitable permissions.

Error logging has its own destination and, on modern MySQL, can use configured error-log components. It is not governed by log_output in the same way as the slow and general logs.

Use common paths as clues

For services and containers:

journalctl -u mysql -f
docker logs -f mysql-container

Use the actual unit or container name. Neither command implies that file logging is disabled: different log types may have different destinations.

Configure file output explicitly

Debian-style packages often read /etc/mysql/mysql.conf.d/mysqld.cnf; RHEL-style installations commonly read /etc/my.cnf and included files. Confirm which option files your service loads.

[mysqld]
log_error = /var/log/mysql/error.log
log_output = FILE
slow_query_log = ON
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 1

Create the destination with the appropriate owner and permissions. Configuration-file changes are applied at startup; some settings also support privileged runtime changes. Follow the deployed version's instructions for error-log destinations rather than assuming every option is dynamically changeable.

Verify collection using new records

After finding the files, DataKit log collection can retain error and slow-query records centrally. Give each source the appropriate parser. Confirm timestamps and severity for error logs, and query duration for slow logs. SQL text can contain business-sensitive values.

Why is /var/log/mysql/ empty? The server may use another directory, stderr, a journal, or TABLE output. Inspect enablement and destination settings together.

Should the general log stay enabled? Usually it is better suited to a bounded investigation because it captures broad client activity and can grow quickly. Define retention if it has a continuing operational purpose.

How do I change the slow threshold? Set long_query_time in seconds, including fractional values such as 0.5. A global change supplies the default for new sessions; existing connections keep their own session values.

See the MySQL server log overview.