The operating system kernel and other processes record a log of events that happen when the system is running. These logs are used to audit the system and to troubleshoot problems. You can use text utilities such as the less and tail commands to inspect these logs.

Red Hat Enterprise Linux uses a standard logging system that is based on the syslog protocol to log the system messages. Many programs use the logging system to record events and to organize them into log files. The systemd-journald and rsyslog services handle the syslog messages in Red Hat Enterprise Linux 9.

The systemd-journald service is at the heart of the operating system event logging architecture. The systemd-journald service collects event messages from many sources:

The systemd-journald service restructures the logs into a standard format and writes them into a structured, indexed system journal. By default, this journal is stored on a file system that does not persist across reboots.

The rsyslog service reads syslog messages that the systemd-journald service receives from the journal when they arrive. The rsyslog service then processes the syslog events, and records them to its log files or forwards them to other services according to its own configuration.

The rsyslog service sorts and writes syslog messages to the log files that do persist across reboots in the /var/log directory. The service also sorts the log messages to specific log files according to the type of program that sent each message and the priority of each syslog message.

In addition to syslog message files, the /var/log directory contains log files from other services on the system. The following table lists some useful files in the /var/log directory.

Some applications do not use the syslog service to manage their log messages. For example, the Apache Web Server saves log messages to files in a subdirectory of the /var/log directory.