{"id":25454,"date":"2024-04-22T08:00:29","date_gmt":"2024-04-22T06:00:29","guid":{"rendered":"https:\/\/www.plesk.com\/?p=25454"},"modified":"2024-04-23T06:15:10","modified_gmt":"2024-04-23T04:15:10","slug":"linux-logs-explained","status":"publish","type":"post","link":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/","title":{"rendered":"Linux Logs Explained"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"25454\" class=\"elementor elementor-25454\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5489b105 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5489b105\" data-element_type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;efde168&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:null,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-07509db9\" data-id=\"07509db9\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-16714f59 elementor-widget elementor-widget-text-editor\" data-id=\"16714f59\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><strong>Linux logs<\/strong> are the bread and butter of every seasoned Linux pro. They\u00b4re like treasure maps, guiding us through the labyrinth of system activities and helping us unravel their mysteries when troubleshooting. If anything goes wrong, they give a useful overview of events in order to help you, the administrator, seek out the culprits.<\/p><p>In this article, we\u00b4ll dive deep into the world of Linux logs. By the end of this exploration, you&#8217;ll be equipped with the knowledge and skills to navigate and leverage logs with confidence and precision.<\/p><h2>Linus logs essentials<\/h2><p>Linux logs are typically stored in the <em><strong>\/var\/log<\/strong><\/em> directory and its subdirectories. Within the <strong><em>\/var\/log<\/em><\/strong> directory, logs are organized into subdirectories based on their respective categories or sources. For example:<\/p><ol><li><p><strong>System Logs<\/strong>: System-related logs, such as kernel messages, boot logs, and general system activity logs, are stored directly in the \/var\/log directory.<\/p><\/li><li><p><strong>Application Logs<\/strong>: Logs generated by specific applications, such as Apache web server logs (\/var\/log\/apache2\/), MySQL database server logs (\/var\/log\/mysql\/), and mail server logs (\/var\/log\/mail\/), are stored in separate subdirectories.<\/p><\/li><li><p><strong>Service Logs<\/strong>: Logs generated by system services, daemons, and background processes are typically stored in subdirectories named after the corresponding services. For example, logs for the SSH service may be found in \/var\/log\/sshd\/.<\/p><\/li><li><p><strong>User Logs<\/strong>: Logs related to user activities, such as login\/logout records and command history, are stored in the \/var\/log\/ directory or its subdirectories, such as \/var\/log\/auth.log.<\/p><\/li><\/ol><p>Organizing logs into specific directories facilitates easy access, management, and analysis, allowing system administrators to efficiently monitor and troubleshoot system activities.<\/p><p>For problems relating to particular apps, the developer decides where best to put the log of events. So with Google Chrome for instance, any time it hangs, you want to look in \u2018~\/.chrome\/Crash Reports\u2019 to discover the gory details of what tripped the system up.<\/p><p>As you can see,<strong> Linux log files<\/strong> cover all kinds of things, like system, kernel, package managers, MySQL and more. But now, we\u2019ll focus on <strong>system logs<\/strong>.<\/p><p><a href=\"https:\/\/www.plesk.com\/plesk360\/?utm_source=google&amp;utm_medium=organic&amp;utm_campaign=plesk360_trafficdrivers_v2\"><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter size-full wp-image-143663\" src=\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2021\/04\/02123500\/Plesk360_750x250_V2.png\" alt=\"Server and Sites monitoring\" width=\"750\" height=\"250\" srcset=\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2021\/04\/02123500\/Plesk360_750x250_V2.png 750w, https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2021\/04\/02123500\/Plesk360_750x250_V2-300x100.png 300w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><\/a><\/p><h2>How can I check Linux logs?<\/h2><p>To access the system directory of a Linux or UNIX-style operating system you will need to tap in the <strong>cd<\/strong> command. From here, you can look at system logs using the <strong>cd \/var\/log command. Type ls <\/strong>to bring up the logs in this directory. <em>Syslog is one of the main ones that you want to be looking at because it keeps track of virtually everything<\/em><em>, except <\/em>auth-related messages.<\/p><p>You also use \/<strong>var\/log\/syslog <\/strong>to scrutinise anything that\u2019s under the syslog. But picking out one particular thing will take some time because it\u2019s usually a pretty big file to wade through. Pressing <em>Shift+G<\/em> will take you all the way to the end, and you\u2019ll know you\u2019re there because you will see the word \u201cEND.\u201d<\/p><p>You can also check logs using <strong>dmesg. This <\/strong>shows the kernel ring buffer and prints everything after sending you to the end of the file. You can then use the <strong>dmesg | less command <\/strong>to scroll through everything it has produced. If you\u2019d like to see log entries relating to the user facility, use <strong>dmesg \u2013facility=user.<\/strong><\/p><p>Finally, as a super-handy command called <strong>tail, which <\/strong>lets you look over log files. It\u2019s so useful because it just displays the last bit of the logs. Which is often where you\u2019ll find the source of the difficulty. Use <strong>tail \/var\/log\/syslog <\/strong>or<strong> tail<\/strong> <strong>-f \/var\/log\/syslog. <em>T<\/em><em>ail<\/em><\/strong> keeps a close eye on the log file, and displays every written to it, which lets you check what\u2019s being added to syslog in real time.<\/p><p>For a particular group of lines (say, the last five) type in <strong>tail<\/strong> <strong>-f -n 5 \/var\/log\/syslog<\/strong>, and you\u2019ll be able to see them. Use Ctrl+C to turn off the tail command.<\/p><h2>Most Valuable Linux Logs Categories<\/h2><p>As seen above, most log directories can be grouped under four headings:<\/p><ul><li>Application Logs<\/li><li>Event Logs<\/li><li>Service Logs<\/li><li>System Logs<\/li><\/ul><p>Checking each log individually would be a daunting task. So that\u2019s why developers rely on log management tools like Retrace. These tools put APM and log management right at your fingertips. With such tools, you have the flexibility to monitor a wide range of metrics tailored to your specific needs. However, certain logs demand immediate attention and should be prioritized for thorough scrutiny. Let\u00b4s see which ones.<\/p><h2>What\u2019s in these Linux Logs?<\/h2><ul><li><strong>\/var\/log\/syslog <\/strong>or <strong>\/var\/log\/messages<\/strong>:<br \/>Shows general messages and info regarding the system. Basically a data log of all activity throughout the global system. Know that everything that happens on Redhat-based systems, like CentOS or Rhel, will go in messages. Whereas for Ubuntu and other Debian systems, they go in Syslog.<\/li><\/ul><ul><li><strong>\/var\/log\/auth.log <\/strong>or <strong>\/var\/log\/secure<\/strong>:<br \/>Keep authentication logs for both successful or failed logins, and authentication processes. Storage depends on system type. For Debian\/Ubuntu, look in \/var\/log\/auth.log. For Redhat\/CentOS, go to \/var\/log\/secure.<\/li><li><strong>\/var\/log\/boot.log<\/strong>: start-up messages and boot info.<\/li><li><strong>\/var\/log\/maillog or var\/log\/mail.log:<\/strong> is for mail server logs, handy for postfix, smtpd, or email-related services info running on your server.<\/li><li><strong>\/var\/log\/kern<\/strong>: keeps in Kernel logs and warning info. Also useful to fix problems with custom kernels.<\/li><li><strong>\/var\/log\/dmesg<\/strong>: a repository for device driver messages. Use <strong>dmesg<\/strong> to see messages in this file.<\/li><li><strong>\/var\/log\/faillog:<\/strong> records info on failed logins. Hence, handy for examining potential security breaches like login credential hacks and brute-force attacks.<\/li><li><strong>\/var\/log\/cron<\/strong>: keeps a record of Crond-related messages (cron jobs). Like when the cron daemon started a job.<\/li><li><strong>\/var\/log\/daemon.log:<\/strong> keeps track of running background services but doesn\u2019t represent them graphically.<\/li><li><strong>\/var\/log\/btmp<\/strong>: keeps a note of all failed login attempts.<\/li><li><strong>\/var\/log\/utmp<\/strong>: current login state by user.<\/li><li><strong>\/var\/log\/wtmp<\/strong>: record of each login\/logout.<\/li><li><strong>\/var\/log\/lastlog<\/strong>: holds every user\u2019s last login. A binary file you can read via <strong>lastlog <\/strong>command.<\/li><li><strong>\/var\/log\/yum.log:<\/strong> holds data on any package installations that used the <strong>yum<\/strong> command. So you can check if all went well.<\/li><li><strong>\/var\/log\/httpd\/<\/strong>: a directory containing error_log and access_log files of the Apache httpd daemon. Every error that httpd comes across is kept in the <strong>error_log <\/strong>file. Think of memory problems and other system-related errors. <strong>access_log<\/strong> logs all requests which come in via HTTP.<\/li><li><strong>\/var\/log\/mysqld.log <\/strong>or<strong> \/var\/log\/mysql.log\u00a0<\/strong>: MySQL log file that records every \u00a0debug, failure and success message, including starting, stopping and restarting of MySQL daemon mysqld. The system decides on the directory.\u00a0RedHat, CentOS, Fedora, and other RedHat-based systems use\u00a0\/var\/log\/mariadb\/mariadb.log. However, Debian\/Ubuntu use \/var\/log\/mysql\/error.log directory.<\/li><li><strong>\/var\/log\/pureftp.log<\/strong>: monitors for FTP connections using the pureftp process. Find data on every connection, FTP login, and authentication failure here.<\/li><li><strong>\/var\/log\/spooler<\/strong>: Usually contains nothing, except rare messages from USENET.<\/li><li><strong>\/var\/log\/xferlog<\/strong>: keeps FTP file transfer sessions. Includes info like file names and user-initiated FTP transfers.<\/li><\/ul><h2>Does Plesk for Linux keep logs too?<\/h2>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4055532f elementor-widget elementor-widget-image\" data-id=\"4055532f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"533\" height=\"324\" src=\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022559\/plesk-onyx-on-linux-screenshot.png\" class=\"attachment-full size-full wp-image-25458\" alt=\"Plesk Onyx on Linux\" srcset=\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022559\/plesk-onyx-on-linux-screenshot.png 533w, https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022559\/plesk-onyx-on-linux-screenshot-300x182.png 300w\" sizes=\"(max-width: 533px) 100vw, 533px\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2d67814c elementor-widget elementor-widget-spacer\" data-id=\"2d67814c\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b9ef2d80 elementor-widget elementor-widget-text-editor\" data-id=\"b9ef2d80\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>As a Linux-friendly hosting panel, <strong>Plesk<\/strong> uses <strong>log files<\/strong> for a wide range of software packages that run under Linux in addition to its own logs. Below, we&#8217;ve compiled a list detailing the locations of <strong>Plesk logs<\/strong>. And we hope it helps you fix issues.<\/p><h3>Plesk System<\/h3><ul><li>Error log: \/var\/log\/sw-cp-server\/error_log and \/var\/log\/sw-cp-server\/sw-engine.log<\/li><\/ul><p>These logs capture error messages and other relevant information related to the operation of the SW-CP-Server, which is responsible for managing the Plesk control panel interface and various administrative tasks within Plesk. Monitoring these logs can provide valuable insights into any issues or errors occurring within the SW-CP-Server service, helping sysadmins diagnose and troubleshoot problems effectively.<\/p><ul><li>Access log: \/usr\/local\/psa\/admin\/logs\/httpsd_access_log<\/li><\/ul><p>Specifically, this log captures information about HTTP requests made to the Plesk control panel, including details such as the IP address of the client making the request, the requested URL, the HTTP status code returned by the server, and other relevant information. Monitoring this access log can provide valuable insights into who is accessing the Plesk control panel and what actions they are performing, which can be useful for security monitoring, troubleshooting, and performance optimization purposes.<\/p><ul><li>Panel log: \/usr\/local\/psa\/admin\/logs\/panel.log<\/li><\/ul><p>This log captures various events and activities related to the Plesk control panel&#8217;s operation and administration. It includes information about user logins, administrative actions, system events, errors, warnings, and other relevant details. Monitoring the panel log is essential for sysadmins to track changes made to the Plesk environment, diagnose issues, troubleshoot errors, and ensure the smooth functioning of the control panel.<\/p><h3>Plesk Installer<\/h3><ul><li>\/var\/log\/plesk\/installer\/autoinstaller3.log<\/li><\/ul><p>The &#8220;\/var\/log\/plesk\/installer\/autoinstaller3.log&#8221; file is part of Plesk&#8217;s installation and update logging system. This log captures detailed information about the installation and update processes performed by the Plesk Installer tool, including the installation or update of Plesk components, third-party software, and system packages. Monitoring this log is essential for sysadmins to track the progress of Plesk installations and updates, diagnose installation failures or errors, and troubleshoot any issues that may arise during the installation or update process.<\/p><ul><li>\/tmp\/autoinstaller3.log<\/li><\/ul><p>Similar to &#8220;\/var\/log\/plesk\/installer\/autoinstaller3.log&#8221;, this log also captures detailed information about the installation and update processes performed by the Plesk Installer tool. However, it is stored in the temporary directory (&#8220;\/tmp\/&#8221;) and may contain temporary logs or data generated during the installation or update process. Monitoring this log can provide additional insights into the installation and update activities, complementing the information available in other Plesk logs.<\/p><h3>Web Presence Builder<\/h3><ul><li>Error log: \/usr\/local\/psa\/admin\/logs\/sitebuilder.log<\/li><\/ul><p>The &#8220;Error log&#8221; at &#8220;\/usr\/local\/psa\/admin\/logs\/sitebuilder.log&#8221; records issues and relevant data related to Plesk&#8217;s Web Presence Builder feature. It&#8217;s essential for sysadmins to troubleshoot any errors users encounter when creating or editing websites in Plesk.<\/p><ul><li>Install\/upgrade logs: \/usr\/local\/sb\/tmp\/<\/li><\/ul><p>The &#8220;Install\/upgrade logs&#8221; directory at &#8220;\/usr\/local\/sb\/tmp\/&#8221; stores logs related to installations and upgrades within Plesk&#8217;s Web Presence Builder feature.<\/p><h3>Backup Manager<\/h3><ul><li>Backup logs: \/usr\/local\/psa\/PMM\/logs\/backup-&lt;datetime&gt;<\/li><\/ul><p>The &#8220;Backup logs&#8221; directory at &#8220;\/usr\/local\/psa\/PMM\/logs\/backup-&lt;datetime&gt;&#8221; contains logs specific to the backup process managed by Plesk&#8217;s Backup Manager.<\/p><ul><li>Restore log: \/usr\/local\/psa\/PMM\/logs\/restore-&lt;datetime&gt;<\/li><\/ul><p>The &#8220;Restore log&#8221; directory at &#8220;\/usr\/local\/psa\/PMM\/logs\/restore-&lt;datetime&gt;&#8221; stores logs related to the restoration process managed by Plesk&#8217;s Backup Manager.<\/p><h3>Plesk Migrator<\/h3><ul><li>\/usr\/local\/psa\/var\/modules\/panel-migrator\/logs\/<\/li><\/ul><p>The &#8220;Plesk Migrator&#8221; directory at &#8220;\/usr\/local\/psa\/var\/modules\/panel-migrator\/logs\/&#8221; is used to store logs related to migration processes facilitated by Plesk&#8217;s Migration Manager. These logs contain detailed information about the migration of websites, databases, email accounts, and other data from one server to another. They help administrators track the progress of migration tasks, diagnose any errors or issues encountered during the migration process, and ensure a smooth transition of data between servers.<\/p><h3>Migration Manager<\/h3><p>These logs document various aspects of the migration, including the source and destination servers, migrated data types (such as websites, databases, email accounts), and any errors or warnings encountered during the migration process.<\/p><ul><li>\/usr\/local\/psa\/PMM\/logs\/migration-&lt;datetime&gt;<\/li><\/ul><h3>Website Import<\/h3><p>These logs record details such as the source of the imported website, the progress of the import process, and any errors encountered during the import operation.<\/p><ul><li>\/usr\/local\/psa\/var\/modules\/site-import\/sessions\/<\/li><\/ul><h3>Health Monitor Manager<\/h3><p>Health Monitor Manager logs contain information about the health status and performance metrics of servers managed by Plesk&#8217;s Health Monitor Manager service. These logs record system alerts, resource usage statistics, and any anomalies detected during health checks.<\/p><ul><li>\/usr\/local\/psa\/admin\/logs\/health-alarm.log<\/li><\/ul><h3>Health Monitor Notification Daemon<\/h3><p>These logs detail alerts related to server health, resource usage, and any abnormalities detected during monitoring.<\/p><ul><li>\/usr\/local\/psa\/admin\/logs\/health-alarm.log<\/li><\/ul><h3>FTP<\/h3><p>These logs record details such as user login attempts, file uploads, downloads, and any errors encountered during FTP sessions.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/xferlog<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><li>\/var\/log\/plesk\/xferlog<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><li>\/var\/log\/secure<\/li><\/ul><h3>Courier-IMAP<\/h3><p>These logs record details such as user login attempts, email retrieval actions, and any errors encountered during IMAP sessions. Monitoring Courier-IMAP logs is essential for sysadmins to troubleshoot email-related issues, diagnose errors, and ensure the smooth functioning of email services hosted on Plesk servers.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/maillog<\/li><\/ul><h3>Postfix<\/h3><p>Postfix logs document the activities and operations of the Postfix mail server on Plesk servers. These logs record information such as incoming and outgoing email delivery attempts, message routing, and any errors or warnings encountered during mail processing.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/maillog<\/li><\/ul><h3>Qmail<\/h3><p>Qmail logs contain information about the operation and activities of the Qmail mail server on Plesk servers. These logs record details such as incoming and outgoing email delivery attempts, message queue management, and any errors or warnings encountered during mail processing.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/maillog<\/li><\/ul><h3>Horde<\/h3><p>Horde logs document the activities and events occurring within the Horde webmail application integrated with Plesk. These logs capture user interactions, email operations, and system-related messages, providing valuable insights into the usage and performance of the webmail interface.<\/p><ul><li>Error log: \/var\/log\/psa-horde\/psa-horde.log<\/li><\/ul><h3>Roundcube<\/h3><p>Monitoring Roundcube logs is essential for sysadmins to troubleshoot user-reported issues, diagnose any errors encountered while using the webmail application, and ensure the smooth operation of email services hosted on Plesk servers.<\/p><ul><li>Error log: \/var\/log\/plesk-roundcube\/errors<\/li><\/ul><h3>SpamAssassin<\/h3><p>Monitoring SpamAssassin logs is crucial for sysadmins to assess the effectiveness of spam filtering, identify false positives or false negatives, and fine-tune spam detection rules to optimize email security.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/maillog<\/li><\/ul><h3>Parallels Premium Antivirus<\/h3><p>Parallels Premium Antivirus logs contain records of antivirus scanning activities performed by the Parallels Premium Antivirus service within Plesk. These logs document scan results, detected threats, and any actions taken by the antivirus software to mitigate security risks.<\/p><ul><li>\/usr\/local\/psa\/var\/log\/maillog<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li>\/var\/drweb\/log\/*<\/li><\/ul><h3>Watchdog (monit)<\/h3><p>Watchdog (monit) logs capture monitoring and alerting events generated by the Watchdog service in Plesk. These logs provide detailed information about system health checks, service availability, resource usage, and any issues detected by the monitoring system. Monitoring Watchdog logs is essential for ensuring the stability, performance, and security of servers managed by Plesk.<\/p><ul><li>\/usr\/local\/psa\/var\/modules\/watchdog\/log\/wdcollect.log<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li>\/var\/log\/wdcollect.log<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li>\/usr\/local\/psa\/var\/modules\/watchdog\/log\/monit.log<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li>\/var\/log\/plesk\/modules\/wdcollect.log<\/li><\/ul><h3>Let\u2019s Encrypt<\/h3><p>Let\u2019s Encrypt logs track the issuance and renewal of SSL\/TLS certificates managed by the Let\u2019s Encrypt service within Plesk. These logs provide valuable information about certificate generation, renewal attempts, validation challenges, and any errors encountered during the process.<\/p><ul><li>\/usr\/local\/psa\/admin\/logs\/panel.log<\/li><\/ul><h3>Plesk-PHP<\/h3><p>Plesk-PHP logs document the activities and errors related to the PHP-FPM service integrated with Plesk. These logs provide insights into the performance, execution, and errors encountered by PHP scripts running on the server. They are essential for troubleshooting PHP-related issues, diagnosing script errors, and optimizing the performance of PHP applications hosted on Plesk servers.<\/p><ul><li>\/var\/log\/plesk-php7x-fpm\/<\/li><\/ul><h3>Acronis Backup<\/h3><p>The logs for Acronis Backup are used to track and record all activities related to backup and recovery operations performed by the Acronis Backup service. They provide detailed information about the status of backups, any errors or warnings encountered during the process, and other relevant data to ensure the reliability and integrity of the backup system.<\/p><ul><li>\/var\/log\/plesk\/panel.log<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><li>\/var\/log\/trueimage-setup.log<ul><li style=\"list-style-type: none;\"><ul><li style=\"list-style-type: none;\">\u00a0<\/li><\/ul><\/li><\/ul><\/li><li>\/opt\/psa\/var\/modules\/acronis-backup\/srv\/log\/<\/li><\/ul><h2>Conclusion<\/h2><p>In conclusion, Linux logs are essential for system admins, serving as invaluable tools for gaining insights into system activities and effectively troubleshooting issues. To extract maximum value from them, it&#8217;s crucial to adhere to best practices.<\/p><p>This includes managing logs well and focusing on critical ones. Also, optimize log analysis for system health. That means knowing where to look, prioritizing the crucial stuff, and fine-tuning your analysis for maximum efficiency. Nail these fundamentals, and you&#8217;ll be running your Linux setup like a well-oiled machine, spotting issues before they even have a chance to surface.<\/p><p>Now that we&#8217;ve explored Linux logs, which ones are the most important in your experience? Share your thoughts with us in the comments below. Your input can help other admins improve their log management strategies and keep their systems running smoothly.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Linux logs are the bread and butter of every seasoned Linux pro. They\u00b4re like treasure maps, guiding us through the labyrinth of system activities and helping us unravel their mysteries when troubleshooting. If anything goes wrong, they give a useful overview of events in order to help you, the administrator, seek out the culprits. In [&hellip;]<\/p>\n","protected":false},"author":44,"featured_media":25456,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[9130,8939,58],"tags":[50,9135,9134,73],"coauthors":[12712],"blocksy_meta":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.7 (Yoast SEO v22.7) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Linux Logs Explained - Full overview of Linux Log Files - Plesk<\/title>\n<meta name=\"description\" content=\"Find out what&#039;s inside all Linux Logs, how to check them and which are the most valuable. We even explain how Plesk Onyx stores Linux Logs.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elvis Plesky\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/\",\"url\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/\",\"name\":\"Linux Logs Explained - Full overview of Linux Log Files - Plesk\",\"isPartOf\":{\"@id\":\"https:\/\/www.plesk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png\",\"datePublished\":\"2024-04-22T06:00:29+00:00\",\"dateModified\":\"2024-04-23T04:15:10+00:00\",\"author\":{\"@id\":\"https:\/\/www.plesk.com\/#\/schema\/person\/64acc004472c57a809a39950e0f10153\"},\"description\":\"Find out what's inside all Linux Logs, how to check them and which are the most valuable. We even explain how Plesk Onyx stores Linux Logs.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage\",\"url\":\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png\",\"contentUrl\":\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png\",\"width\":1920,\"height\":400,\"caption\":\"Linux Logs Explained - Plesk\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.plesk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Linux Logs Explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.plesk.com\/#website\",\"url\":\"https:\/\/www.plesk.com\/\",\"name\":\"Plesk\",\"description\":\"Build, Secure and Run Apps and Websites\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.plesk.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.plesk.com\/#\/schema\/person\/64acc004472c57a809a39950e0f10153\",\"name\":\"Elvis Plesky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.plesk.com\/#\/schema\/person\/image\/0e57b77e6fd2339c50bd6d5333b10c0c\",\"url\":\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2017\/11\/27015230\/elvis_plesky_plesk-300x300-96x96.png\",\"contentUrl\":\"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2017\/11\/27015230\/elvis_plesky_plesk-300x300-96x96.png\",\"caption\":\"Elvis Plesky\"},\"description\":\"Our fun and curious team mascot's always plugged into the latest trends. He's here to share his knowledge and help you solve your tech problems.\",\"url\":\"https:\/\/www.plesk.com\/blog\/author\/elvis-plesky\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Linux Logs Explained - Full overview of Linux Log Files - Plesk","description":"Find out what's inside all Linux Logs, how to check them and which are the most valuable. We even explain how Plesk Onyx stores Linux Logs.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/","twitter_misc":{"Written by":"Elvis Plesky","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/","url":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/","name":"Linux Logs Explained - Full overview of Linux Log Files - Plesk","isPartOf":{"@id":"https:\/\/www.plesk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage"},"image":{"@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage"},"thumbnailUrl":"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png","datePublished":"2024-04-22T06:00:29+00:00","dateModified":"2024-04-23T04:15:10+00:00","author":{"@id":"https:\/\/www.plesk.com\/#\/schema\/person\/64acc004472c57a809a39950e0f10153"},"description":"Find out what's inside all Linux Logs, how to check them and which are the most valuable. We even explain how Plesk Onyx stores Linux Logs.","breadcrumb":{"@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#primaryimage","url":"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png","contentUrl":"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2018\/11\/27022555\/blog_header_1920x400_2-linux-logs-explained.png","width":1920,"height":400,"caption":"Linux Logs Explained - Plesk"},{"@type":"BreadcrumbList","@id":"https:\/\/www.plesk.com\/blog\/featured\/linux-logs-explained\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.plesk.com\/"},{"@type":"ListItem","position":2,"name":"Linux Logs Explained"}]},{"@type":"WebSite","@id":"https:\/\/www.plesk.com\/#website","url":"https:\/\/www.plesk.com\/","name":"Plesk","description":"Build, Secure and Run Apps and Websites","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.plesk.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.plesk.com\/#\/schema\/person\/64acc004472c57a809a39950e0f10153","name":"Elvis Plesky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.plesk.com\/#\/schema\/person\/image\/0e57b77e6fd2339c50bd6d5333b10c0c","url":"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2017\/11\/27015230\/elvis_plesky_plesk-300x300-96x96.png","contentUrl":"https:\/\/cdn1.plesk.com\/wp-content\/uploads\/2017\/11\/27015230\/elvis_plesky_plesk-300x300-96x96.png","caption":"Elvis Plesky"},"description":"Our fun and curious team mascot's always plugged into the latest trends. He's here to share his knowledge and help you solve your tech problems.","url":"https:\/\/www.plesk.com\/blog\/author\/elvis-plesky\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/posts\/25454"}],"collection":[{"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/comments?post=25454"}],"version-history":[{"count":17,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/posts\/25454\/revisions"}],"predecessor-version":[{"id":237700,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/posts\/25454\/revisions\/237700"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/media\/25456"}],"wp:attachment":[{"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/media?parent=25454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/categories?post=25454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/tags?post=25454"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.plesk.com\/wp-json\/wp\/v2\/coauthors?post=25454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}