What is a log?
A log is a running record of what a program did and when, written to a file so you can look back when something breaks.
Drafted with AI from official documentation. Scripts were run in a test environment and repository links verified. Awaiting a human check. Did it work for you? Last edited Outdated?
A log is a chronological list of messages that a program writes while it runs: it started, it handled a request, it failed to connect. Think of a ship’s logbook: nobody reads it on a calm day, but after a storm it tells you exactly what happened and in which order. Each line usually carries a timestamp and a severity such as INFO, WARNING or ERROR.
Logs live in /var/log on Linux, in the systemd journal, in the output of docker logs, or in a central tool like Loki or Elasticsearch on bigger systems. The first thing anyone does when a service misbehaves is read its log. Good logs are plain text, one event per line, and rotated so they do not fill the disk.
tail -f /var/log/syslog
journalctl -u ssh --since today
docker logs -f webSee also: What is a daemon or service? and What is a process?
Did this work for you?
No votes yet. Be the first.
If it did not work, the report form below tells the editors what went wrong.
See also
- 0193 Linux logs reference: journalctl, journald storage, logrotate and centralized logging Read and filter systemd journal logs, keep their disk use in check, rotate classic log files with logrotate, and understand when to… Intermediate · Cheat sheet · Linux Article Linux administration · Logs 15 Oct 2026
- 0323 Fix: Failed to start service, how to read systemctl status and journalctl Job for x.service failed tells you only that the service did not start. The real reason is in systemctl status and journalctl… Beginner · Fixes an error · Linux Article Logs · Services & systemd 15 Oct 2026
- 0371 Where are the logs? journalctl, /var/log and container logs A practical map of where Linux programs write their logs and the commands to read them: journalctl filters, the classic files under… Beginner · Step by step · Linux Article Logs 15 Oct 2026
- 0373 Loki: ship and search logs Run Loki, Grafana Alloy and Grafana with Docker Compose, collect the systemd journal and /var/log files with a short Alloy configuration, and… Intermediate · Step by step · Linux Article Logs 15 Oct 2026
- 0432 Try Sigma rules against your own logs Install the sigma-cli converter, take a rule from the public SigmaHQ library, convert it into a query for a log tool you… Intermediate · Step by step · Linux, macOS Article Logs · Security resources & detection 15 Oct 2026
- 0443 Security monitoring explained: IDS, SIEM, EDR and where the logs go A plain language map of the security monitoring tool families, what each one watches, how they feed one another, and where the… Beginner · Explains an idea · Any system Article Detection & threat hunting · Logs 15 Oct 2026
Repos in the wild
- Loki: horizontally scalable log aggregation inspired by Prometheus grafana/loki The Grafana Loki repository: a log store that indexes labels instead of full text, queried with LogQL from Grafana or logcli, with the single-binary mode for one host and the microservices mode for clusters. GitHub
- Wazuh: an open source security platform with agents, SIEM and XDR wazuh/wazuh Wazuh installs a small agent on each server and sends its logs, file changes and package lists to a central manager that detects intrusions, checks configurations and reports vulnerabilities. GitHub
- Zeek: network security monitoring that turns traffic into logs zeek/zeek Zeek, formerly Bro, watches network traffic and writes structured logs of every connection, DNS query, HTTP request and certificate it sees. Analysts search those logs to understand what happened on the network. GitHub
- pySigma: the Python library that converts Sigma rules into queries SigmaHQ/pySigma pySigma parses Sigma detection rules and, with backend plugins, converts them into native queries for Splunk, Elastic, Loki, Sentinel and other log platforms. It is the engine inside the sigma-cli tool. GitHub
History
Every saved edit is kept. The plot on the sleeve draws one line per edit. Open any edit to see exactly what changed.
- Dominik +808 chars