Ubuntu Log File Locations
In this guide, you'll find every log file path on Ubuntu. These paths apply to Ubuntu 24.04 LTS (Noble Numbat), Ubuntu 22.04 LTS (Jammy Jellyfish), Ubuntu 20.04 LTS (Focal Fossa), Ubuntu 25.10 (Questing Quokka), Ubuntu 25.04 (Plucky Puffin), and Ubuntu 24.10 (Oracular Oriole). All log locations below remain consistent across all 6 versions unless noted otherwise.
Debian-basedLTSapt9 services covered
Quick Reference
| Service | Primary Log Path | Category |
|---|---|---|
| syslog | /var/log/syslog | System |
| journald | /var/log/journal/ | System |
| Nginx | /var/log/nginx/access.log | Web Server |
| Apache2 | /var/log/apache2/access.log | Web Server |
| PHP-FPM | /var/log/php8.3-fpm.log | Runtime |
| MySQL | /var/log/mysql/error.log | Database |
| MariaDB | /var/log/mysql/error.log | Database |
| BIND9 (DNS Server) | /var/log/syslog | Network |
| ISC DHCP Server | /var/log/syslog | Network |
syslog
SystemLog Files
| Path | Description |
|---|---|
/var/log/syslog | Main system log — captures messages from most services and daemons |
/var/log/kern.log | Kernel messages including hardware errors and driver issues |
/var/log/auth.log | Authentication events — SSH logins, sudo usage, PAM activity |
/var/log/dpkg.log | Package installation and removal history |
/var/log/boot.log | Boot process messages |
/var/log/dmesg | Kernel ring buffer — hardware detection at boot time |
Configuration Files
| Path | Description |
|---|---|
/etc/rsyslog.conf | Main rsyslog configuration |
/etc/rsyslog.d/ | Drop-in configuration directory for rsyslog |
/etc/logrotate.conf | Global log rotation configuration |
/etc/logrotate.d/ | Per-service log rotation rules |
Common Commands
View syslog
sudo tail -100 /var/log/syslogFollow syslog in real time
sudo tail -f /var/log/syslogView authentication log
sudo tail -100 /var/log/auth.logSearch syslog for a service
sudo grep 'nginx' /var/log/syslogView kernel messages
dmesg | tail -50View systemd journal
journalctl -xeFollow journal in real time
journalctl -fView journal for a specific service
journalctl -u nginx.service --no-pager -n 100View logs since last boot
journalctl -bView logs from a specific time
journalctl --since "2024-01-15 10:00" --until "2024-01-15 12:00"Install
Pre-installed with the OSjournald
SystemLog Files
| Path | Description |
|---|---|
/var/log/journal/ | Persistent binary journal storage (if configured) |
/run/log/journal/ | Volatile journal storage (default — lost on reboot) |
Configuration Files
| Path | Description |
|---|---|
/etc/systemd/journald.conf | journald configuration — storage, size limits, rate limiting |
Common Commands
View all journal entries
journalctl --no-pager -n 200View journal for a unit
journalctl -u sshd.service -n 50View only errors and above
journalctl -p errCheck journal disk usage
journalctl --disk-usageRotate and vacuum old journals
sudo journalctl --rotate && sudo journalctl --vacuum-time=7dInstall
Pre-installed with systemdNginx
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/nginx/access.log | HTTP request log — records every request with status code, size, referrer, and user agent |
/var/log/nginx/error.log | Error log — config errors, upstream failures, connection issues |
Configuration Files
| Path | Description |
|---|---|
/etc/nginx/nginx.conf | Main Nginx configuration — worker processes, logging format, includes |
/etc/nginx/sites-available/ | Virtual host configuration files |
/etc/nginx/sites-enabled/ | Symlinks to active virtual host configs |
/etc/nginx/conf.d/ | Additional configuration drop-in directory |
Common Commands
sudo tail -100 /var/log/nginx/error.logsudo tail -f /var/log/nginx/error.logsudo tail -f /var/log/nginx/access.logsudo grep ' 50[0-9] ' /var/log/nginx/access.logsudo grep 'example.com' /var/log/nginx/access.logsudo nginx -tsudo systemctl reload nginxsudo systemctl status nginxInstall
sudo apt update && sudo apt install -y nginxApache2
Web ServerLog Files
| Path | Description |
|---|---|
/var/log/apache2/access.log | HTTP request log in Combined Log Format |
/var/log/apache2/error.log | Error log — module errors, script failures, startup issues |
/var/log/apache2/other_vhosts_access.log | Access log for virtual hosts using the default vhost_combined format |
Configuration Files
| Path | Description |
|---|---|
/etc/apache2/apache2.conf | Main Apache configuration |
/etc/apache2/sites-available/ | Virtual host configuration files |
/etc/apache2/sites-enabled/ | Symlinks to active virtual host configs |
/etc/apache2/mods-available/ | Available Apache modules |
/etc/apache2/mods-enabled/ | Enabled Apache modules |
/etc/apache2/envvars | Environment variables including log directory |
Common Commands
sudo tail -100 /var/log/apache2/error.logsudo tail -f /var/log/apache2/error.logsudo tail -f /var/log/apache2/access.logsudo grep ' 500 ' /var/log/apache2/access.logsudo apachectl configtestsudo systemctl reload apache2sudo systemctl status apache2sudo apachectl -MInstall
sudo apt update && sudo apt install -y apache2PHP-FPM
RuntimeLog Files
| Path | Description |
|---|---|
/var/log/php8.3-fpm.log | PHP-FPM master process log — pool startup, worker errors, slow requests |
/var/log/syslog | PHP-FPM errors may also appear in syslog depending on configuration |
Configuration Files
| Path | Description |
|---|---|
/etc/php/8.3/fpm/php-fpm.conf | Main PHP-FPM configuration — process management, logging |
/etc/php/8.3/fpm/pool.d/www.conf | Default pool configuration — listen socket, user, error log, slowlog |
/etc/php/8.3/fpm/php.ini | PHP runtime configuration for FPM (display_errors, error_reporting, log_errors) |
/etc/php/8.3/cli/php.ini | PHP runtime configuration for CLI scripts |
Common Commands
sudo tail -100 /var/log/php8.3-fpm.logsudo tail -f /var/log/php8.3-fpm.logjournalctl -u php8.3-fpm.service -n 50sudo php-fpm8.3 -tsudo systemctl reload php8.3-fpmsudo systemctl status php8.3-fpmphp -vphp -mInstall
sudo apt update && sudo apt install -y php8.3-fpmMySQL
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mysql/error.log | MySQL server error log — startup failures, crashes, warnings, and InnoDB recovery |
/var/log/mysql/mysql-slow.log | Slow query log — queries exceeding long_query_time (if enabled) |
/var/log/mysql/mysql.log | General query log — every SQL statement received (disabled by default, high I/O) |
Configuration Files
| Path | Description |
|---|---|
/etc/mysql/mysql.conf.d/mysqld.cnf | Main MySQL server configuration |
/etc/mysql/my.cnf | Global MySQL configuration file (usually includes conf.d/) |
/etc/mysql/conf.d/ | Additional MySQL configuration drop-in directory |
Common Commands
sudo tail -100 /var/log/mysql/error.logsudo tail -f /var/log/mysql/error.logsudo tail -100 /var/log/mysql/mysql-slow.logjournalctl -u mysql.service -n 50sudo systemctl status mysqlmysql -e "SHOW VARIABLES LIKE '%log%';"mysql -e "SET GLOBAL slow_query_log = 'ON';"Install
sudo apt update && sudo apt install -y mysql-serverMariaDB
DatabaseLog Files
| Path | Description |
|---|---|
/var/log/mysql/error.log | MariaDB server error log — startup failures, crashes, warnings |
/var/log/mysql/mariadb-slow.log | Slow query log (if enabled via slow_query_log = 1) |
Configuration Files
| Path | Description |
|---|---|
/etc/mysql/mariadb.conf.d/50-server.cnf | Main MariaDB server configuration |
/etc/mysql/my.cnf | Global configuration file |
/etc/mysql/mariadb.cnf | MariaDB-specific global config (includes mariadb.conf.d/) |
Common Commands
sudo tail -100 /var/log/mysql/error.logsudo tail -f /var/log/mysql/error.logjournalctl -u mariadb.service -n 50sudo systemctl status mariadbmysql -e "SHOW VARIABLES LIKE '%log%';"Install
sudo apt update && sudo apt install -y mariadb-serverBIND9 (DNS Server)
NetworkLog Files
| Path | Description |
|---|---|
/var/log/syslog | Default log destination — BIND messages tagged as 'named' (grep for named) |
/var/log/named/named.log | Dedicated BIND log file (requires logging channel configuration) |
/var/log/named/query.log | DNS query log — records every lookup (requires query logging enabled) |
/var/cache/bind/ | Zone transfer journals and dynamic update files |
Configuration Files
| Path | Description |
|---|---|
/etc/bind/named.conf | Main BIND configuration file |
/etc/bind/named.conf.options | Global options — forwarders, recursion, DNSSEC, listen addresses |
/etc/bind/named.conf.local | Local zone definitions (your custom zones) |
/etc/bind/named.conf.default-zones | Default forward and reverse zones (localhost, broadcast) |
/etc/bind/db.* | Zone database files (e.g., db.example.com, db.192) |
/etc/bind/rndc.key | RNDC authentication key for remote control |
/etc/default/named | Service startup options (e.g., -4 for IPv4-only) |
Common Commands
Check BIND config syntax
sudo named-checkconfCheck a zone file
sudo named-checkzone example.com /etc/bind/db.example.comView BIND status
sudo rndc statusEnable query logging
sudo rndc querylog onReload all zones
sudo rndc reloadFlush DNS cache
sudo rndc flushView BIND logs via journal
journalctl -u named.service --no-pager -n 100Search syslog for BIND messages
sudo grep named /var/log/syslog | tail -50Install
sudo apt install bind9 bind9-utils bind9-dnsutilsISC DHCP Server
NetworkLog Files
| Path | Description |
|---|---|
/var/log/syslog | Default log destination — DHCP messages tagged as 'dhcpd' (grep for dhcpd) |
/var/log/dhcp.log | Dedicated DHCP log file (requires rsyslog rule — see notes) |
/var/lib/dhcp/dhcpd.leases | Active DHCPv4 lease database — every lease grant, renewal, and expiry |
/var/lib/dhcp/dhcpd6.leases | Active DHCPv6 lease database |
Configuration Files
| Path | Description |
|---|---|
/etc/dhcp/dhcpd.conf | Main DHCPv4 configuration — subnets, pools, reservations |
/etc/dhcp/dhcpd6.conf | DHCPv6 configuration |
/etc/default/isc-dhcp-server | Service defaults — listening interfaces (INTERFACESv4/INTERFACESv6) |
Common Commands
Test DHCP config syntax
sudo dhcpd -t -cf /etc/dhcp/dhcpd.confView active leases
sudo cat /var/lib/dhcp/dhcpd.leasesView DHCP logs via journal
journalctl -u isc-dhcp-server.service --no-pager -n 100Search syslog for DHCP messages
sudo grep dhcpd /var/log/syslog | tail -50Check DHCP server status
sudo systemctl status isc-dhcp-serverCount active leases
grep -c '^lease' /var/lib/dhcp/dhcpd.leasesInstall
sudo apt install isc-dhcp-serverTroubleshooting
Permission denied viewing logs
Most log files require root access. Use sudo before your command, or add your user to the adm group: sudo usermod -aG adm $USER
Log file is empty
Verify the service is running with systemctl status service-name. Check the service config to confirm logging is enabled and the log path is correct.
How to enable debug logging
For Nginx, set error_log /var/log/nginx/error.log debug; in nginx.conf. For Apache, set LogLevel debug in httpd.conf. For PHP-FPM, set log_level = debug in pool config. Remember to revert after debugging.
Log rotation not working
Test with sudo logrotate -d /etc/logrotate.d/nginx (dry run) or sudo logrotate -f /etc/logrotate.d/nginx (force). Check that the logrotate cron job exists in /etc/cron.daily/logrotate.
Covered Versions
The log file paths on this page apply to all of the following versions. PHP-FPM paths differ by version — see the table below.
Ubuntu 24.04 LTSLTS
Noble Numbat
PHP 8.3EOL:
Ubuntu 22.04 LTSLTS
Jammy Jellyfish
PHP 8.1EOL:
Ubuntu 20.04 LTSLTS
Focal Fossa
PHP 7.4EOL:
Ubuntu 25.10
Questing Quokka
PHP 8.4EOL:
Ubuntu 25.04
Plucky Puffin
PHP 8.4EOL:
Ubuntu 24.10
Oracular Oriole
PHP 8.3EOL:
PHP-FPM Path Differences
| Version | PHP | Config Path |
|---|---|---|
| 24.04 | 8.3 | /etc/php/8.3/fpm/ |
| 22.04 | 8.1 | /etc/php/8.1/fpm/ |
| 20.04 | 7.4 | /etc/php/7.4/fpm/ |
| 25.10 | 8.4 | /etc/php/8.4/fpm/ |
| 25.04 | 8.4 | /etc/php/8.4/fpm/ |
| 24.10 | 8.3 | /etc/php/8.3/fpm/ |