How do I find where a Linux application sends its logs?
Applications may write to the journal, their own files, a container log driver or a remote collector. A conventional path under /var/log is only a possibility. Inspect the service’s output configuration and application documentation before concluding that a missing file means logging is broken.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Inspect selected service properties
Use the exact unit name. Query only relevant properties instead of printing a full environment or complete configuration that may contain secrets.
systemctl show example.service -p FragmentPath -p StandardOutput -p StandardErrorThese properties help identify the unit file and standard-stream destinations. An application can still maintain separate internal file logging.
2. Check the journal for this unit
If stdout or stderr is journal-backed, recent entries can confirm that path. Then inspect the application’s documented logging setting through its supported configuration workflow.
sudo journalctl -u example.service -n 40 --no-pagerLook for startup messages that identify the application logger. Do not publish access tokens or connection strings found in logs.
Check the result
- A controlled application event appears in the expected destination, and its timestamps and retention are suitable for support.
Troubleshooting
- The unit sends output to null
- That only describes standard streams; consult the application’s own logger settings before changing service output.
- The process is containerised
- Inspect its container-runtime logging configuration and forwarding path rather than editing a guessed host log file.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.