RHEL Family Log File Locations
In this guide, you'll find every log file path on RHEL Family. These paths apply to AlmaLinux 9, AlmaLinux 10, Rocky Linux 9, Amazon Linux 2023, CloudLinux 9, Rocky Linux 10, Fedora 43, Fedora 42, Fedora 41, and Fedora 40. All log locations below remain consistent across all 10 versions unless noted otherwise.
RHEL-baseddnf9 services covered
Quick Reference
| Service | Primary Log Path | Category |
|---|---|---|
| syslog | /var/log/messages | System |
| journald | /var/log/journal/ | System |
| Nginx | /var/log/nginx/access.log | Web Server |
| httpd (Apache) | /var/log/httpd/access_log | Web Server |
| PHP-FPM | /var/log/php-fpm/error.log | Runtime |
| MariaDB | /var/log/mariadb/mariadb.log | Database |
| MySQL | /var/log/mysqld.log | Database |
| BIND (DNS Server) | /var/named/data/named.run | Network |
| ISC DHCP Server | /var/log/messages | Network |
syslog
SystemLog Files
| Path | Description |
|---|---|
/var/log/messages | Main system log — captures messages from most services and daemons |
/var/log/secure | Authentication events — SSH logins, sudo usage, PAM activity |
/var/log/dnf.log | Package installation and removal history (dnf) |
/var/log/boot.log | Boot process messages |
/var/log/dmesg | Kernel ring buffer — hardware detection at boot time |
/var/log/cron | Cron job execution log |
Configuration Files
| Path | Description |
|---|---|
/etc/rsyslog.conf | Main rsyslog configuration |
/etc/rsyslog.d/ | Drop-in configuration directory for rsyslog |
/etc/logrotate.conf | Global log rotation configuration |
/etc/logrotate.d/ | Per-service log rotation rules |
Common Commands
View messages log
sudo tail -100 /var/log/messagesFollow messages in real time
sudo tail -f /var/log/messagesView authentication log
sudo tail -100 /var/log/secureSearch messages for a service
sudo grep 'httpd' /var/log/messagesView kernel messages
dmesg | tail -50View systemd journal
journalctl -xeFollow journal in real time
journalctl -fView journal for a specific service
journalctl -u httpd.service --no-pager -n 100View logs since last boot
journalctl -bView cron logs
sudo tail -50 /var/log/cronInstall
Pre-installed with the OSjournald
SystemLog Files
| Path | Description |
|---|---|
/var/log/journal/ | Persistent binary journal storage (enabled by default on RHEL 9+) |
/run/log/journal/ | Volatile journal storage (fallback) |
Configuration Files
| Path | Description |
|---|---|
/etc/systemd/journald.conf | journald configuration — storage, size limits, rate limiting |
Common Commands
View all journal entries
journalctl --no-pager -n 200View journal for a unit
journalctl -u sshd.service -n 50View only errors and above
journalctl -p errCheck journal disk usage
journalctl --disk-usageRotate and vacuum old journals
sudo journalctl --rotate && sudo journalctl --vacuum-time=7dInstall
Pre-installed with systemdNginx
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/nginx/access.log | HTTP request log — records every request with status code, size, referrer, and user agent |
/var/log/nginx/error.log | Error log — config errors, upstream failures, connection issues |
Configuration Files
| Path | Description |
|---|---|
/etc/nginx/nginx.conf | Main Nginx configuration — worker processes, logging format, includes |
/etc/nginx/conf.d/ | Server block configuration files (default: default.conf) |
Common Commands
sudo tail -100 /var/log/nginx/error.logsudo tail -f /var/log/nginx/error.logsudo tail -f /var/log/nginx/access.logsudo grep ' 50[0-9] ' /var/log/nginx/access.logsudo grep 'example.com' /var/log/nginx/access.logsudo nginx -tsudo systemctl reload nginxsudo systemctl status nginxInstall
sudo dnf install -y nginxhttpd (Apache)
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/httpd/access_log | HTTP request log in Combined Log Format |
/var/log/httpd/error_log | Error log — module errors, script failures, startup issues |
/var/log/httpd/ssl_access_log | HTTPS request log (when mod_ssl is enabled) |
/var/log/httpd/ssl_error_log | HTTPS error log (when mod_ssl is enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/httpd/conf/httpd.conf | Main Apache configuration |
/etc/httpd/conf.d/ | Additional configuration files (e.g., ssl.conf, php.conf) |
/etc/httpd/conf.modules.d/ | Module loading configuration |
Common Commands
sudo tail -100 /var/log/httpd/error_logsudo tail -f /var/log/httpd/error_logsudo tail -f /var/log/httpd/access_logsudo grep ' 500 ' /var/log/httpd/access_logsudo apachectl configtestsudo systemctl reload httpdsudo systemctl status httpdsudo httpd -MInstall
sudo dnf install -y httpdPHP-FPM
RuntimeLog Files
| Path | Description |
|---|---|
/var/log/php-fpm/error.log | PHP-FPM master process and pool error log |
/var/log/php-fpm/www-error.log | Default www pool PHP error log |
/var/log/php-fpm/www-slow.log | Slow request log for the www pool (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/php-fpm.conf | Main PHP-FPM configuration — process management, logging |
/etc/php-fpm.d/www.conf | Default pool configuration — listen socket, user, error log, slowlog |
/etc/php.ini | PHP runtime configuration (display_errors, error_reporting, log_errors) |
Common Commands
sudo tail -100 /var/log/php-fpm/error.logsudo tail -f /var/log/php-fpm/error.logjournalctl -u php-fpm.service -n 50sudo php-fpm -tsudo systemctl reload php-fpmsudo systemctl status php-fpmphp -vphp -mInstall
sudo dnf install -y php-fpmMariaDB
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mariadb/mariadb.log | MariaDB server error log — startup failures, crashes, warnings |
/var/log/mariadb/mariadb-slow.log | Slow query log (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/my.cnf | Global MariaDB configuration |
/etc/my.cnf.d/ | Configuration drop-in directory (mariadb-server.cnf, client.cnf) |
/etc/my.cnf.d/mariadb-server.cnf | Server-specific configuration |
Common Commands
sudo tail -100 /var/log/mariadb/mariadb.logsudo tail -f /var/log/mariadb/mariadb.logjournalctl -u mariadb.service -n 50sudo systemctl status mariadbmysql -e "SHOW VARIABLES LIKE '%log%';"sudo mysql_secure_installationInstall
sudo dnf install -y mariadb-serverMySQL
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mysqld.log | MySQL server error log — startup failures, crashes, warnings, and InnoDB recovery |
/var/log/mysql-slow.log | Slow query log (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/my.cnf | Global MySQL configuration |
/etc/my.cnf.d/ | Configuration drop-in directory |
Common Commands
sudo tail -100 /var/log/mysqld.logsudo tail -f /var/log/mysqld.logjournalctl -u mysqld.service -n 50sudo systemctl status mysqldmysql -e "SHOW VARIABLES LIKE '%log%';"sudo grep 'temporary password' /var/log/mysqld.logInstall
sudo dnf install -y mysql-serverBIND (DNS Server)
NetworkLog Files
| Path | Description |
|---|---|
/var/named/data/named.run | Default BIND log output file |
/var/log/messages | Syslog destination — BIND messages tagged as 'named' (grep for named) |
/var/log/named/ | Custom log directory (requires logging channel configuration and SELinux context) |
Configuration Files
| Path | Description |
|---|---|
/etc/named.conf | Main BIND configuration file — options, logging, zone includes |
/etc/named.rfc1912.zones | RFC 1912 zone definitions (localhost, loopback) |
/var/named/ | Zone files directory (e.g., example.com.zone) |
/etc/named/ | Additional configuration directory |
/etc/rndc.key | RNDC authentication key for remote control |
/etc/sysconfig/named | Service startup options (e.g., OPTIONS="-4") |
Common Commands
Check BIND config syntax
sudo named-checkconf /etc/named.confCheck a zone file
sudo named-checkzone example.com /var/named/example.com.zoneView BIND status
sudo rndc statusEnable query logging
sudo rndc querylog onReload all zones
sudo rndc reloadFlush DNS cache
sudo rndc flushView BIND logs via journal
journalctl -u named.service --no-pager -n 100Search messages for BIND entries
sudo grep named /var/log/messages | tail -50Install
sudo dnf install bind bind-utilsISC DHCP Server
NetworkLog Files
| Path | Description |
|---|---|
/var/log/messages | Default log destination — DHCP messages tagged as 'dhcpd' (grep for dhcpd) |
/var/log/dhcpd.log | Dedicated DHCP log file (requires rsyslog rule — see notes) |
/var/lib/dhcpd/dhcpd.leases | Active DHCPv4 lease database — every lease grant, renewal, and expiry |
/var/lib/dhcpd/dhcpd6.leases | Active DHCPv6 lease database |
Configuration Files
| Path | Description |
|---|---|
/etc/dhcp/dhcpd.conf | Main DHCPv4 configuration — subnets, pools, reservations |
/etc/dhcp/dhcpd6.conf | DHCPv6 configuration |
/etc/sysconfig/dhcpd | Service startup options — listening interfaces (DHCPDARGS) |
Common Commands
Test DHCP config syntax
sudo dhcpd -t -cf /etc/dhcp/dhcpd.confView active leases
sudo cat /var/lib/dhcpd/dhcpd.leasesView DHCP logs via journal
journalctl -u dhcpd.service --no-pager -n 100Search messages for DHCP entries
sudo grep dhcpd /var/log/messages | tail -50Check DHCP server status
sudo systemctl status dhcpdCount active leases
grep -c '^lease' /var/lib/dhcpd/dhcpd.leasesInstall
sudo dnf install dhcp-serverTroubleshooting
Permission denied viewing logs
Most log files require root access. Use sudo before your command, or add your user to the adm group: sudo usermod -aG adm $USER
Log file is empty
Verify the service is running with systemctl status service-name. Check the service config to confirm logging is enabled and the log path is correct.
How to enable debug logging
For Nginx, set error_log /var/log/nginx/error.log debug; in nginx.conf. For Apache, set LogLevel debug in httpd.conf. For PHP-FPM, set log_level = debug in pool config. Remember to revert after debugging.
Log rotation not working
Test with sudo logrotate -d /etc/logrotate.d/nginx (dry run) or sudo logrotate -f /etc/logrotate.d/nginx (force). Check that the logrotate cron job exists in /etc/cron.daily/logrotate.
Covered Versions
The log file paths on this page apply to all of the following versions.
AlmaLinux 9
PHP 8.0EOL:
AlmaLinux 10
PHP 8.3EOL:
Rocky Linux 9
PHP 8.0EOL:
Amazon Linux 2023
PHP 8.1EOL:
CloudLinux 9
PHP 8.0EOL:
Rocky Linux 10
PHP 8.3EOL:
Fedora 43
PHP 8.4EOL:
Fedora 42
PHP 8.4EOL:
Fedora 41
PHP 8.3EOL:
Fedora 40
PHP 8.3EOL: