How to view syslog in ubuntu?

Question

Follow up from this question, LogBack Syslog not working java

I use command below to view syslog in ubuntu 16.04 but get below result. Is it the correct way to view?

user@xxx:~$ tail -f /var/log/syslog Jun  6 23:08:50 xxx systemd[1]:
Starting Hostname Service... Jun  6 23:08:50 xxx dbus[889]: [system]
Successfully activated service 'org.freedesktop.hostname1' Jun  6
23:08:50 xxx systemd[1]: Started Hostname Service. Jun  6 23:09:41 xxx
gnome-session[2645]: (nautilus:2860): Gtk-WARNING **: Attempting to
read the recently used resources file at
'/home/xxx/.local/share/recently-used.xbel', but the parser failed:
Failed to open file '/home/xxx/.local/share/recently-used.xbel':
Permission denied. Jun  6 23:09:41 xxx org.gtk.vfs.Daemon[2508]:
(gvfsd-recent:15282): Gtk-WARNING **: Attempting to read the recently
used resources file at '/home/xxx/.local/share/recently-used.xbel',
but the parser failed: Failed to open file
'/home/xxx/.local/share/recently-used.xbel': Permission denied. Jun  6
23:09:41 xxx gnome-session[2645]: (zeitgeist-datahub:3069):
Gtk-WARNING **: Attempting to read the recently used resources file at
'/home/xxx/.local/share/recently-used.xbel', but the parser failed:
Failed to open file '/home/seng/.local/share/recently-used.xbel':
Permission denied. Jun  6 23:09:49 xxx gnome-session[2645]:
(nautilus:2860): Gtk-WARNING **: Attempting to read the recently used
resources file at '/home/xxx/.local/share/recently-used.xbel', but the
parser failed: Failed to open file
'/home/xxx/.local/share/recently-used.xbel': Permission denied. Jun  6
23:09:49 xxx org.gtk.vfs.Daemon[2508]: (gvfsd-recent:15282):
Gtk-WARNING **: Attempting to read the recently used resources file at
'/home/xxx/.local/share/recently-used.xbel', but the parser failed:
Failed to open file '/home/xxx/.local/share/recently-used.xbel':
Permission denied. Jun  6 23:09:49 xxx gnome-session[2645]:
(zeitgeist-datahub:3069): Gtk-WARNING **: Attempting to read the
recently used resources file at
'/home/seng/.local/share/recently-used.xbel', but the parser failed:
Failed to open file '/home/xxx/.local/share/recently-used.xbel':
Permission denied. Jun  6 23:17:01 xxx CRON[18877]: (root) CMD (   cd
/ && run-parts --report /etc/cron.hourly)

Try cat /var/log/syslog (small part of the output)

Jun  6 23:37:26 xxx whoopsie[1040]: [23:37:26] online
Jun  6 23:37:26 xxx avahi-daemon[1023]: Registering new address record for 2001:e68:4424:afab:c31f:c843:2351:c58 on wlp6s0.*.
Jun  6 23:37:28 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 4340ms.
Jun  6 23:37:32 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 9080ms.
Jun  6 23:37:41 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 17540ms.
Jun  6 23:37:59 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 34190ms.
Jun  6 23:38:09 xxx NetworkManager[1013]: <warn>  [1496763489.9447] dhcp6 (wlp6s0): request timed out
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9448] dhcp6 (wlp6s0): state changed unknown -> timeout
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9456] dhcp6 (wlp6s0): canceled DHCP transaction, DHCP client pid 19397
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9456] dhcp6 (wlp6s0): state changed timeout -> done
user@xxx:/$

Try cat /var/log/syslog | tail -f

user@xxx:/$ cat /var/log/syslog | tail -f
Jun  6 23:37:26 xxx whoopsie[1040]: [23:37:26] online
Jun  6 23:37:26 xxx avahi-daemon[1023]: Registering new address record for 2001:e68:4424:afab:c31f:c843:2351:c58 on wlp6s0.*.
Jun  6 23:37:28 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 4340ms.
Jun  6 23:37:32 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 9080ms.
Jun  6 23:37:41 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 17540ms.
Jun  6 23:37:59 xxx dhclient[19397]: XMT: Solicit on wlp6s0, interval 34190ms.
Jun  6 23:38:09 xxx NetworkManager[1013]: <warn>  [1496763489.9447] dhcp6 (wlp6s0): request timed out
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9448] dhcp6 (wlp6s0): state changed unknown -> timeout
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9456] dhcp6 (wlp6s0): canceled DHCP transaction, DHCP client pid 19397
Jun  6 23:38:09 xxx NetworkManager[1013]: <info>  [1496763489.9456] dhcp6 (wlp6s0): state changed timeout -> done
user@xxx:/$

If you try `tail /var/log/syslog > /tmp/log` and then use `gedit` to read `/tmp/log`, have you got same problem ? — romaric crailox, Jun 06 '17 at 15:29
@slim I want to read from java. I have linked my previous question to here. — Tony, Jun 06 '17 at 15:43
@Tony we shouldn't need to refer to another question to work out what your question is here. — slim, Jun 06 '17 at 15:49
`cat` output looks correct, right? How about `cat /var/log/syslog | tail -f` — slim, Jun 06 '17 at 15:58
The `cat` and `cat | tail` outputs both look correct. What do you think is wrong with it? — slim, Jun 06 '17 at 16:07
@slim The output of `syslog` looked correct (Y) but no idea why the message send from JAVA not receiving in the syslog. Would it because I wrote the wrong `logback.xml` ? (In my previous question) — Tony, Jun 06 '17 at 16:09
@Tony well, that's not what you asked. You've given an example syslog that looks fine apart from screwed up newlines. Several people have spent time trying to diagnose your screwed up newlines. — slim, Jun 06 '17 at 16:13
@slim I will mark this post as solved. Would you mind to have a look on my previous question ? Thanks. — Tony, Jun 06 '17 at 16:15
@slim Not sure is it because of the syslogHost and facility. — Tony, Jun 06 '17 at 16:35
Replying to an older posts, but wanted to mention that there's no need to `cat | tail`, you can just do `tail -f /var/log/syslog` to follow the end of the syslog. — BlueCacti, Sep 20 '21 at 08:22

score 29 · Accepted Answer · answered Jun 06 '17 at 15:29

29

Looks like you are trying to read syslog from Java, not from an interactive terminal. The text looks like a correct output, but with smashed formatting.

tail -f is good for interactive terminals.

Try cat /var/log/syslog, or just open /var/log/syslog as a file (if your process has enough permissions).

answered Jun 06 '17 at 15:29

Dmitriusan

11,525
3
38
38

are you trying to read file manually from the console, or to read it programmatically from Java? In a first case, use `cat /var/log/syslog` – Dmitriusan Jun 06 '17 at 15:42
then just open file from Java like that https://www.mkyong.com/java/how-to-read-file-in-java-fileinputstream/ (make sure to replace file path with `/var/log/syslog`) – Dmitriusan Jun 06 '17 at 15:44
There's nothing about Java in your question. If you're using `ProcessBuilder` or similar to execute `tail`, then add your code to the question. – slim Jun 06 '17 at 15:44
@slim I follow this tutorial, but no idea how to read that message that was sent from Java in syslog ! – Tony Jun 06 '17 at 15:47
@Tony unless you want to read the message using Java, the source of the messages is irrelevant to the question you've asked. – slim Jun 06 '17 at 15:47
@slim ok, forget about that, but what is the way to view syslog ? – Tony Jun 06 '17 at 15:48
3

did you try `cat /var/log/syslog` or `less /var/log/syslog` ? – Dmitriusan Jun 06 '17 at 15:50
Appreciate your help :) – Tony Jun 06 '17 at 16:16

score 9 · Answer 2 · answered Jun 06 '17 at 15:56

In a normal terminal window (in Ubuntu, normally Gnome Terminal), what you've done - sudo tail /var/log/syslog should display with newlines such that date/time stamps line up on the left.

Either you're not using a normal terminal window, or some control characters have knocked your terminal into a state where newlines don't display properly.

If you're using something other than a terminal window (perhaps something in your IDE?), then use a normal one instead.

tail -f /var/log/syslog is for following along as the file grows.

You can dump the whole of the file into the terminal with cat /var/log/syslog.

You can interactively scroll through the file with less /var/log/syslog.

If you prefer to use a GUI editor, you can open /var/log/syslog in a text editor like gEdit or Atom, although you would have to run those editors as root -- the responsible thing to do would be to copy the file, make it readable by your user, and open that.

journalctl -f ??????????? – Time Killer Nov 07 '22 at 07:07 — Time Killer, Nov 07 '22 at 07:07

How to view syslog in ubuntu?

2 Answers2