\section{System Log Files}

\begin{frame}
   {Log Files}

   \begin{itemize}
      \item
      Most files are in \filelink{/var/log}
      \item
      Exact names vary with \textbf{Linux} distribution, e.g.:
      \begin{itemize}
         \item
         \filelink{/var/log/messages} on \textbf{RHEL}
         \item
         \filelink{/var/log/syslog} on \textbf{Ubuntu}
      \end{itemize}
      View continuously as new lines appear with:
      \begin{cmd}
$ sudo tail -f /var/log/messages
      \end{cmd}
      or
      \begin{cmd}
$ dmesg -w
      \end{cmd}
      which shows only kernel related messages
   \end{itemize}

\end{frame}

\cprotect\note{

   System log files are essential for monitoring and
   troubleshooting. In \textbf{Linux} these messages appear
   in various files under \filelink{/var/log}.

   Ultimate control of how messages are dealt with is
   controlled by the \textbf{syslogd} (usually
   \textbf{rsyslogd} on modern systems) daemon, common to
   many \textbf{UNIX}-like operating systems.  The newer
   \textbf{systemd}-based systems can use \textbf{journalctl}
   instead, but usually retain \textbf{syslogd} and cooperate
   with it.

   Important messages are sent not only to the logging files,
   but also to the system \textbf{console} window; if you are
   not running a  graphical interface  or are at a virtual terminal, you
   will see them directly there as well. In addition these
   messages will be copied to \filelink{/var/log/messages}
   (or to \filelink{/var/log/syslog} on \textbf{Ubuntu}) but
   if you are running \textbf{X} or \textbf{Wayland}
   you have to take some  steps to view them as they come in fresh.

}

\begin{frame}
   {Important Log Files}

   Here are some of the important log files found under
   \filelink{/var/log}:

   \begin{table}[H]
      \caption{System Log Files}
      \vspace{-15pt}
   \end{table}

   \small{\begin{tcolorbox}[tabularx={p{0.25\textwidth}|X}]
         \textbf{File}
         &
         \textbf{Purpose}
         \\ \hline\hline
         \verb?boot.log?
         &
         System boot messages
         \\ \hline
         \verb?dmesg?
         &
         Kernel messages saved after boot. To see the current
         contents of the kernel message buffer, type \textbf{dmesg}.
         \\ \hline
         \verb?messages? or \verb?syslog?
         &
         All important system messages
         \\ \hline
         \verb?secure?
         &
         Security related messages
      \end{tcolorbox}}

\end{frame}

\cprotect\note{

   A good way to see log messages is to open a terminal
   window, and in that window type \texttt{tail -f
      /var/log/messages}. On a \textbf{GNOME} desktop you can
   also access the messages by clicking on
   \verb?System->Administration->System Log? or
   \verb?Applications->System Tools->Log File Viewer?  in
   your Desktop menus, and other desktops have similar links
   you can locate.

   In order to keep log files from growing without bound, the
   \textbf{logrotate} program is run periodically and
   keeps 4 previous copies (by default) of the log files
   (optionally compressed) and is controlled by
   \filelink{/etc/logrotate.conf}.

}
