Server Log File Locations
Find the exact path to any log file on your Linux server or hosting panel. Select your operating system below for a complete reference of log file paths, configuration files, and commands for every service.
Ubuntu
Debian
RHEL Family
Hosting Panels
cPanel & WHM
cPanel 118, cPanel 116, cPanel 114, cPanel 112, cPanel 110, cPanel 108, cPanel 106, cPanel 104, cPanel 102, cPanel 100, cPanel 98, cPanel 96, cPanel 94, cPanel 92
6 services
Plesk
Plesk Obsidian 18.0.70, Plesk Obsidian 18.0.60, Plesk Obsidian 18.0.50, Plesk Obsidian 18.0.40, Plesk Obsidian 18.0.30, Plesk Obsidian 18.0.20, Plesk Onyx 17.8, Plesk Onyx 17.5, Plesk Onyx 17.0
7 services
Debian vs RHEL: Key Differences
| Feature | Debian/Ubuntu | RHEL/AlmaLinux/Rocky |
|---|---|---|
| Package Manager | apt | dnf |
| Firewall | ufw | firewalld |
| System Log | /var/log/syslog | /var/log/messages |
| Auth Log | /var/log/auth.log | /var/log/secure |
| Package Log | /var/log/dpkg.log | /var/log/dnf.log |
| Apache Package | apache2 | httpd |
| Apache Logs | /var/log/apache2/ | /var/log/httpd/ |
| PHP-FPM Config | /etc/php/{ver}/fpm/ | /etc/php-fpm.d/ |
| SELinux Audit | N/A | /var/log/audit/audit.log |
Understanding Linux Log Systems
Modern Linux systems use a dual logging architecture with both traditional text logs and systemd's binary journal:
rsyslog (Traditional)
Writes human-readable text files to /var/log/. You can read these with cat, grep, tail, and other standard tools. Most services still write to these files for compatibility.
journald (systemd)
Stores structured binary logs with rich metadata (timestamps, PIDs, service names). Access via journalctl. Supports powerful filtering like journalctl -u nginx.service --since today.
In most distributions, rsyslog reads from journald and writes to text files, so you get both structured querying and classic grep-friendly logs.
Common journalctl Commands
journalctl -xe— recent errorsjournalctl -u nginx.service— logs for a specific servicejournalctl -f— follow logs in real timejournalctl --since "1 hour ago"— time-based filtering
Log Rotation with logrotate
The logrotate utility prevents log files from growing indefinitely by rotating, compressing, and deleting old logs automatically.
Main Configuration
/etc/logrotate.conf — global defaults (rotate weekly, keep 4 weeks, compress rotated logs)
Service Configs
/etc/logrotate.d/ — per-service rotation rules (e.g., nginx, apache2, mysql)
Rotated logs get numbered extensions (.1, .2, .3) or date stamps, and older logs are compressed with gzip (.gz). If a log is missing, check for /var/log/service/log.1.gz in the same directory.
Common Log Viewing Commands
Essential Commands
tail -f /var/log/nginx/error.logFollow a log file in real time (Ctrl+C to stop)
grep "error" /var/log/syslogSearch for a pattern in a log file
journalctl -u nginx.service -fFollow systemd logs for a specific service
less /var/log/mysql/error.logView large log files with pagination and search
zcat /var/log/nginx/access.log.1.gzRead compressed rotated logs without decompressing
Related Tools
HTTP Status Codes
Look up HTTP status codes you find in server logs
SSL/TLS Errors
Diagnose SSL/TLS errors from Certbot or web server logs
SMTP Error Codes
Troubleshoot email delivery errors from mail server logs
Port Scanner
Check if your service is listening on the expected port
DNS Inspector
Verify DNS resolves to your server
Cloudflare Error Reference
Decode Cloudflare 5xx and 1xxx errors found in access logs