Find system logs on Linux

There is no single syslog file guaranteed to exist on every Linux system. Traditional file destinations are usually under /var/log, while a systemd host may keep its journal persistently under /var/log/journal or temporarily under /run/log/journal.

Start with the logging services and configuration installed on the machine. A missing /var/log/syslog can be normal on a journal-only host.

Check common locations

These are conventions, not distribution guarantees. Fedora and minimal or container-oriented images may use the journal without the expected traditional file. An administrator can also change any rsyslog output path.

Related files, when configured, include /var/log/auth.log or /var/log/secure for authentication, /var/log/kern.log for kernel messages, and application directories such as /var/log/nginx/ or /var/log/mysql/. Some installations create /var/log/dmesg for boot output; others require journalctl -k or dmesg instead.

Query the journal directly

journalctl -u nginx.service
journalctl --since '1 hour ago'
journalctl -f
journalctl -k
journalctl --list-boots

The journal is structured storage, not a text file to inspect with cat. Access can require sudo or membership in an authorized group. The journalctl documentation explains filtering and boot selection.

If expected history disappears after a restart, inspect journald's Storage configuration and the availability of persistent storage. Files under /run are normally volatile. A readable current journal does not prove that previous boots were retained.

Follow the configured destinations and retention

Inspect /etc/rsyslog.conf and its includes to find file actions or remote forwarding routes. An application running in a container may write stdout and stderr for the runtime to collect instead of creating a host syslog file.

Traditional text files are often rotated using /etc/logrotate.conf and files in /etc/logrotate.d/. The frequency, compression, and retained count are configuration choices; there is no universal weekly schedule. Journald has separate size, age, and storage controls documented in journald.conf.

Before installing another logging daemon merely to obtain a familiar filename, confirm whether the existing journal or remote collector already holds the event. Choose the source that matches the service and time window you are investigating.