How to Read Logs on a Linux Server (journalctl and /var/log)
When something on a server doesn't work, the answer is almost always in a log. The trick is knowing where to look and how to filter out the thousands of lines that don't matter. Modern Ubuntu keeps most logs in the journal, read with journalctl, with a few older programs still writing files under /var/log.
Quick reference
| What you want | Command | |
|---|---|---|
| Logs for one service | journalctl -u nginx | |
| Last 50 lines | journalctl -u nginx -n 50 | |
| Watch live | journalctl -u nginx -f | |
| Since the last boot | journalctl -b | |
| Errors only | journalctl -p err -b | |
| A time window | journalctl --since "1 hour ago" | |
| Failed logins | `journalctl -u ssh | grep Failed` |
1. Logs for a service
journalctl -u nginx -n 50
-u picks the service (the same name you use with systemctl), -n 50 the last 50 lines. Newest at the bottom. Without -n you get everything in a pager: End key jumps to the latest, q quits.
Add --no-pager if you'd rather it just printed and finished.
2. Watch a log live
journalctl -u nginx -f
Leave this running in one window, reproduce the problem in another, and watch the error appear. Ctrl + C stops following.
3. Narrow by time
journalctl --since "10 minutes ago"
journalctl --since "2026-10-08 09:00" --until "2026-10-08 09:30"
journalctl --since today
4. Only the serious stuff
journalctl -p err -b
-p err shows errors and worse; -p warning includes warnings. -b limits it to the current boot, which is usually what you care about. -b -1 is the previous boot — handy when the server rebooted unexpectedly.
5. The whole system, biggest problems first
journalctl -b -p err --no-pager | tail -n 30
systemctl --failed
Those two lines are a good first move whenever a server "feels wrong".
The files in /var/log
Some programs still write their own files:
| File | What's in it |
|---|---|
| /var/log/nginx/error.log | Nginx problems |
| /var/log/nginx/access.log | Every web request |
| /var/log/auth.log | Logins and sudo (older Ubuntu) |
| /var/log/ufw.log | Blocked firewall traffic |
| /var/log/dpkg.log | What apt installed and when |
Read them with less, or watch with sudo tail -f /var/log/nginx/error.log. grep finds lines containing a word: grep -i "denied" /var/log/nginx/error.log.
Stop logs filling the disk
journalctl --disk-usage
sudo journalctl --vacuum-size=500M
To make the limit permanent, edit /etc/systemd/journald.conf, set SystemMaxUse=500M, and sudo systemctl restart systemd-journald. Files in /var/log are rotated automatically by logrotate, so they rarely cause trouble.
Troubleshooting
"No journal files were found." Run it with sudo, or add yourself to the group: sudo usermod -aG systemd-journal john and log in again.
Timestamps are in the wrong time zone. Set the server's zone (tutorial 9), or use journalctl --utc.
Nothing in the log for the service that's failing. It may log to a file instead — check the program's docs, or sudo ls -lt /var/log | head to see what's been written to recently.
Wrapping up
journalctl -u service -n 50 for one thing, -f to watch, -p err -b for everything that's gone wrong since boot, and tail -f for the files in /var/log. The error message you need is in there; these filters just get you to it faster.
