How do I access the system logs in current versions of Raspbian? Where are these logs stored?

  • 2
    Which log file? Feb 20 '18 at 22:18
  • The error log file. Feb 20 '18 at 23:20
  • That is an important detail that belongs in your question (and should have been included from the start), not the comments. Likewise the distro you are using as mentioned in @joan's answer. You may also want to look at the find command man find. Feb 20 '18 at 23:25
  • One thing which can be said with certainty about the log file is that it's somewhere on the SD card. Feb 21 '18 at 8:57
  • There isn't really a system wide log dedicated to just errors, so I have edited your question to reflect this. Log messages are instead sorted in terms of priority and origin. A low priority message may or may not be reporting an error. Higher priority messages may be more likely to involve errors, but this is still not necessarily the case.
    – goldilocks
    Mar 4 '18 at 19:51

Raspbian comes with systemd. I prefer to use this progressive system. Systemd has a consistent journaling with journalctl with no need to know where log files are stored. But to answer your question if you also like to use journald, this is stored in /var/log/journal. For enabling persistent logging in journald and get access to it you have [1]:

To enable persistent logging, create /var/log/journal:

 mkdir -p /var/log/journal
 systemd-tmpfiles --create --prefix /var/log/journal

systemd will make the journal files owned by the "systemd-journal" group and add an ACL for read permissions for users in the "adm" group. To grant a user read access to the system journal, add them to one of the two groups.

This will allow you to look at previous boot logs with e. g. "journalctl -b -1".

If you enable persistent logging, consider uninstalling rsyslog or any other system-log-daemon, to avoid logging everything twice.

Some examples how to get log "files": get last boot log

rpi3 ~$ journalctl -b

Get kernel logging (was dmesg)

rpi3 ~$ journalctl -k

Get continous showing log (as taken with tail -f on old style logs)

rpi3 ~$ journalctl -f

Get log from the end with many details

rpi3 ~$ journalctl -xe

Or get details from services, e.g. network

rpi3 ~$ systemctl status systemd-networkd
# or
rpi3 ~$ systemctl status networking

Try it. This already works with current logging. You do not need to have it persistent. But if you want a history you should make it persistent of course.

[1] /usr/share/doc/systemd/README.Debian.gz


I'm running Linux raspberrypi 4.14.98-v7+ and I can access system logs by running:

tail -f /var/log/syslog

Depends on the operating system you are using.

Raspbian puts most logs in directory /var/log.


Which log file? There are many. Most of the log files are in /var/log.

However, there is a command called "dmesg" which allows you to read the kernel ring buffer (the kernel log). This will often tell you things that might have gone wrong with the boot sequence and is the most useful thing I've found to find out what is wrong.

I often use it as "dmesg | tail" or "dmesg | more"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.