CentOS & RHEL Legacy Log File Locations
In this guide, you'll find every log file path on CentOS & RHEL Legacy. These paths apply to CentOS Stream 9, CentOS 8, CentOS 7, AlmaLinux 8, and Rocky Linux 8. All log locations below remain consistent across all 5 versions unless noted otherwise.
RHEL-basedyum / dnf9 services covered
Quick Reference
| Service | Primary Log Path | Category |
|---|---|---|
| syslog | /var/log/messages | System |
| journald | /var/log/journal/ | System |
| Nginx | /var/log/nginx/access.log | Web Server |
| httpd (Apache) | /var/log/httpd/access_log | Web Server |
| PHP-FPM | /var/log/php-fpm/error.log | Runtime |
| MariaDB | /var/log/mariadb/mariadb.log | Database |
| MySQL | /var/log/mysqld.log | Database |
| BIND (DNS Server) | /var/named/data/named.run | Network |
| ISC DHCP Server | /var/log/messages | Network |
syslog
SystemLog Files
| Path | Description |
|---|---|
/var/log/messages | Main system log — captures messages from most services and daemons |
/var/log/secure | Authentication events — SSH logins, sudo usage, PAM activity |
/var/log/dnf.log | Package installation and removal history (dnf) |
/var/log/boot.log | Boot process messages |
/var/log/dmesg | Kernel ring buffer — hardware detection at boot time |
/var/log/cron | Cron job execution log |
Configuration Files
| Path | Description |
|---|---|
/etc/rsyslog.conf | Main rsyslog configuration |
/etc/rsyslog.d/ | Drop-in configuration directory for rsyslog |
/etc/logrotate.conf | Global log rotation configuration |
/etc/logrotate.d/ | Per-service log rotation rules |
Common Commands
View messages log
sudo tail -100 /var/log/messagesFollow messages in real time
sudo tail -f /var/log/messagesView authentication log
sudo tail -100 /var/log/secureSearch messages for a service
sudo grep 'httpd' /var/log/messagesView kernel messages
dmesg | tail -50View systemd journal
journalctl -xeFollow journal in real time
journalctl -fView journal for a specific service
journalctl -u httpd.service --no-pager -n 100View logs since last boot
journalctl -bView cron logs
sudo tail -50 /var/log/cronInstall
Pre-installed with the OSjournald
SystemLog Files
| Path | Description |
|---|---|
/var/log/journal/ | Persistent binary journal storage (enabled by default on RHEL 9+) |
/run/log/journal/ | Volatile journal storage (fallback) |
Configuration Files
| Path | Description |
|---|---|
/etc/systemd/journald.conf | journald configuration — storage, size limits, rate limiting |
Common Commands
View all journal entries
journalctl --no-pager -n 200View journal for a unit
journalctl -u sshd.service -n 50View only errors and above
journalctl -p errCheck journal disk usage
journalctl --disk-usageRotate and vacuum old journals
sudo journalctl --rotate && sudo journalctl --vacuum-time=7dInstall
Pre-installed with systemdNginx
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/nginx/access.log | HTTP request log — records every request with status code, size, referrer, and user agent |
/var/log/nginx/error.log | Error log — config errors, upstream failures, connection issues |
Configuration Files
| Path | Description |
|---|---|
/etc/nginx/nginx.conf | Main Nginx configuration — worker processes, logging format, includes |
/etc/nginx/conf.d/ | Server block configuration files (default: default.conf) |
Common Commands
sudo tail -100 /var/log/nginx/error.logsudo tail -f /var/log/nginx/error.logsudo tail -f /var/log/nginx/access.logsudo grep ' 50[0-9] ' /var/log/nginx/access.logsudo grep 'example.com' /var/log/nginx/access.logsudo nginx -tsudo systemctl reload nginxsudo systemctl status nginxInstall
sudo dnf install -y nginxhttpd (Apache)
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/httpd/access_log | HTTP request log in Combined Log Format |
/var/log/httpd/error_log | Error log — module errors, script failures, startup issues |
/var/log/httpd/ssl_access_log | HTTPS request log (when mod_ssl is enabled) |
/var/log/httpd/ssl_error_log | HTTPS error log (when mod_ssl is enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/httpd/conf/httpd.conf | Main Apache configuration |
/etc/httpd/conf.d/ | Additional configuration files (e.g., ssl.conf, php.conf) |
/etc/httpd/conf.modules.d/ | Module loading configuration |
Common Commands
sudo tail -100 /var/log/httpd/error_logsudo tail -f /var/log/httpd/error_logsudo tail -f /var/log/httpd/access_logsudo grep ' 500 ' /var/log/httpd/access_logsudo apachectl configtestsudo systemctl reload httpdsudo systemctl status httpdsudo httpd -MInstall
sudo dnf install -y httpdPHP-FPM
RuntimeLog Files
| Path | Description |
|---|---|
/var/log/php-fpm/error.log | PHP-FPM master process and pool error log |
/var/log/php-fpm/www-error.log | Default www pool PHP error log |
/var/log/php-fpm/www-slow.log | Slow request log for the www pool (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/php-fpm.conf | Main PHP-FPM configuration — process management, logging |
/etc/php-fpm.d/www.conf | Default pool configuration — listen socket, user, error log, slowlog |
/etc/php.ini | PHP runtime configuration (display_errors, error_reporting, log_errors) |
Common Commands
sudo tail -100 /var/log/php-fpm/error.logsudo tail -f /var/log/php-fpm/error.logjournalctl -u php-fpm.service -n 50sudo php-fpm -tsudo systemctl reload php-fpmsudo systemctl status php-fpmphp -vphp -mInstall
sudo dnf install -y php-fpmMariaDB
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mariadb/mariadb.log | MariaDB server error log — startup failures, crashes, warnings |
/var/log/mariadb/mariadb-slow.log | Slow query log (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/my.cnf | Global MariaDB configuration |
/etc/my.cnf.d/ | Configuration drop-in directory (mariadb-server.cnf, client.cnf) |
/etc/my.cnf.d/mariadb-server.cnf | Server-specific configuration |
Common Commands
sudo tail -100 /var/log/mariadb/mariadb.logsudo tail -f /var/log/mariadb/mariadb.logjournalctl -u mariadb.service -n 50sudo systemctl status mariadbmysql -e "SHOW VARIABLES LIKE '%log%';"sudo mysql_secure_installationInstall
sudo dnf install -y mariadb-serverMySQL
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mysqld.log | MySQL server error log — startup failures, crashes, warnings, and InnoDB recovery |
/var/log/mysql-slow.log | Slow query log (if enabled) |
Configuration Files
| Path | Description |
|---|---|
/etc/my.cnf | Global MySQL configuration |
/etc/my.cnf.d/ | Configuration drop-in directory |
Common Commands
sudo tail -100 /var/log/mysqld.logsudo tail -f /var/log/mysqld.logjournalctl -u mysqld.service -n 50sudo systemctl status mysqldmysql -e "SHOW VARIABLES LIKE '%log%';"sudo grep 'temporary password' /var/log/mysqld.logInstall
sudo dnf install -y mysql-serverBIND (DNS Server)
NetworkLog Files
| Path | Description |
|---|---|
/var/named/data/named.run | Default BIND log output file |
/var/log/messages | Syslog destination — BIND messages tagged as 'named' (grep for named) |
/var/log/named/ | Custom log directory (requires logging channel configuration and SELinux context) |
Configuration Files
| Path | Description |
|---|---|
/etc/named.conf | Main BIND configuration file — options, logging, zone includes |
/etc/named.rfc1912.zones | RFC 1912 zone definitions (localhost, loopback) |
/var/named/ | Zone files directory (e.g., example.com.zone) |
/etc/named/ | Additional configuration directory |
/etc/rndc.key | RNDC authentication key for remote control |
/etc/sysconfig/named | Service startup options (e.g., OPTIONS="-4") |
Common Commands
Check BIND config syntax
sudo named-checkconf /etc/named.confCheck a zone file
sudo named-checkzone example.com /var/named/example.com.zoneView BIND status
sudo rndc statusEnable query logging
sudo rndc querylog onReload all zones
sudo rndc reloadFlush DNS cache
sudo rndc flushView BIND logs via journal
journalctl -u named.service --no-pager -n 100Search messages for BIND entries
sudo grep named /var/log/messages | tail -50Install
sudo dnf install bind bind-utilsISC DHCP Server
NetworkLog Files
| Path | Description |
|---|---|
/var/log/messages | Default log destination — DHCP messages tagged as 'dhcpd' (grep for dhcpd) |
/var/log/dhcpd.log | Dedicated DHCP log file (requires rsyslog rule — see notes) |
/var/lib/dhcpd/dhcpd.leases | Active DHCPv4 lease database — every lease grant, renewal, and expiry |
/var/lib/dhcpd/dhcpd6.leases | Active DHCPv6 lease database |
Configuration Files
| Path | Description |
|---|---|
/etc/dhcp/dhcpd.conf | Main DHCPv4 configuration — subnets, pools, reservations |
/etc/dhcp/dhcpd6.conf | DHCPv6 configuration |
/etc/sysconfig/dhcpd | Service startup options — listening interfaces (DHCPDARGS) |
Common Commands
Test DHCP config syntax
sudo dhcpd -t -cf /etc/dhcp/dhcpd.confView active leases
sudo cat /var/lib/dhcpd/dhcpd.leasesView DHCP logs via journal
journalctl -u dhcpd.service --no-pager -n 100Search messages for DHCP entries
sudo grep dhcpd /var/log/messages | tail -50Check DHCP server status
sudo systemctl status dhcpdCount active leases
grep -c '^lease' /var/lib/dhcpd/dhcpd.leasesInstall
sudo dnf install dhcp-serverTroubleshooting
Permission denied viewing logs
Most log files require root access. Use sudo before your command, or add your user to the adm group: sudo usermod -aG adm $USER
Log file is empty
Verify the service is running with systemctl status service-name. Check the service config to confirm logging is enabled and the log path is correct.
How to enable debug logging
For Nginx, set error_log /var/log/nginx/error.log debug; in nginx.conf. For Apache, set LogLevel debug in httpd.conf. For PHP-FPM, set log_level = debug in pool config. Remember to revert after debugging.
Log rotation not working
Test with sudo logrotate -d /etc/logrotate.d/nginx (dry run) or sudo logrotate -f /etc/logrotate.d/nginx (force). Check that the logrotate cron job exists in /etc/cron.daily/logrotate.
Covered Versions
The log file paths on this page apply to all of the following versions.
CentOS Stream 9
EOL:
CentOS 8
EOL:
CentOS 7
EOL:
AlmaLinux 8
EOL:
Rocky Linux 8
EOL: