Linux: Logs, Cron & Archiving

/var/log

Standard directory where most system and application logs live

syslog (Ubuntu) vs messages (RHEL/CentOS)

General system log — same purpose, different filename by distro

auth.log (Ubuntu) vs secure (RHEL/CentOS)

Authentication/security events — SSH logins, sudo usage — same purpose, different filename by distro

dmesg

Kernel ring buffer messages — boot-time and hardware-level events

dmesg command

Can also be run directly as a command to view the kernel ring buffer live, not just read from a log file

/var/log//

Many applications (nginx, mysql, etc.) get their own log subdirectory

tail -f (log files)

Follow/watch a flat log file live — same purpose as journalctl -f, but for non-systemd-managed logs

journalctl

Queries systemd's journal — a structured, binary log store, the modern complement to flat log files

journalctl -u

Logs for one specific systemd service

journalctl -f

Follow/tail logs live

journalctl -xe

Recent logs with extra context, common after a failure

journalctl --since

Time-scoped filtering (e.g. --since "1 hour ago")

journalctl -b

View logs since the last boot

journalctl -p err

Filter by priority/severity level

journalctl disk usage

The journal can grow large over time — journalctl --disk-usage shows current size, vacuum flags can trim it

journalctl --vacuum-size / --vacuum-time

Trims the journal down to a target size or age

logrotate

Automates management of log files — prevents excessive disk usage, maintains performance

/etc/logrotate.conf

Main global config — default rotation settings (frequency, compression, retention)

/etc/logrotate.d/

Per-service/application config files — take precedence over the global default

logrotate directives (common)

rotate (how many old logs to keep), compress, daily/weekly/monthly, size (rotate at a threshold instead of schedule)

Why logs matter for timestamps

Log correlation across multiple servers depends on accurate/synced clocks (NTP) — otherwise event ordering during an incident becomes unreliable

Cron

Time-based scheduler for running commands/scripts automatically

Cron field order

minute (0-59) hour (0-23) day-of-month (1-31) month (1-12) day-of-week (0-6, Sun=0)

Cron: 0 2 * * *

Every day at 2:00 AM

Cron: */15 * * * *

Every 15 minutes

Cron: 0 9 * * 1

Every Monday at 9:00 AM

Cron env variable gotcha

Cron jobs don't inherit your interactive shell's PATH or other env vars — use absolute paths or set PATH explicitly in the job

/etc/cron.d/

System-wide cron jobs, one file per job — often used by installed packages

/etc/crontab

The main system crontab — not tied to any single user's personal crontab

/etc/cron.allow and /etc/cron.deny

Control which users are permitted/denied use of crontab — allow takes precedence if both exist

cron.allow vs cron.deny precedence

If cron.allow exists, ONLY listed users may use crontab (deny is ignored). If only cron.deny exists, everyone EXCEPT listed users may use it

crontab -e

Edit your personal crontab

crontab -l

List current cron jobs

crontab -r

Remove all cron jobs

crontab -u

Edit another user's crontab (requires privileges)

Systemd Timers

Modern cron alternative — better logging (via journalctl), dependency management, catch-up on missed runs

tar

(tape archive) Bundles files/directories into a single .tar file — archiving, NOT compression

gzip

Compresses a single file, usually paired with tar first

Compression concept

Finds and eliminates redundancy in data, re-encoding it more efficiently rather than removing information

tar -cvf

Create an archive (c=create, v=verbose, f=filename)

tar -xvf

Extract an archive

tar -tvf

List contents without extracting

tar -czvf

Create AND compress (gzip) in one step

tar -xzvf

Extract a gzip-compressed tarball

gzip

Compress in place — DELETES the original file by default

gzip -k

Compress but keep the original file

gunzip

Decompress a .gz file

zip / unzip

Alternative archive format, cross-platform (Windows-compatible unlike tar), bundles AND compresses in one format

tar vs zip

tar+gzip is the Linux-native standard