Or what can we infer from the names of log files?

For example, when I want to check the Xorg logs, I find three files:


You can also find many such log files under /var/log/:

$ ls /var/log/*log*
/var/log/alternatives.log        /var/log/dpkg.log.4.gz
/var/log/alternatives.log.1      /var/log/dpkg.log.5.gz
/var/log/alternatives.log.10.gz  /var/log/dpkg.log.6.gz
/var/log/alternatives.log.11.gz  /var/log/dpkg.log.7.gz
/var/log/alternatives.log.12.gz  /var/log/dpkg.log.8.gz
/var/log/alternatives.log.2.gz   /var/log/dpkg.log.9.gz
/var/log/alternatives.log.3.gz   /var/log/faillog
/var/log/alternatives.log.4.gz   /var/log/fontconfig.log
/var/log/alternatives.log.5.gz   /var/log/kern.log
/var/log/alternatives.log.6.gz   /var/log/kern.log.1
/var/log/alternatives.log.7.gz   /var/log/kern.log.2.gz
/var/log/alternatives.log.8.gz   /var/log/kern.log.3.gz
/var/log/alternatives.log.9.gz   /var/log/kern.log.4.gz
/var/log/apport.log              /var/log/lastlog
/var/log/apport.log.1            /var/log/mail.log
/var/log/apport.log.2.gz         /var/log/mail.log.1
/var/log/apport.log.3.gz         /var/log/mail.log.2.gz
/var/log/apport.log.4.gz         /var/log/mail.log.3.gz
/var/log/apport.log.5.gz         /var/log/mail.log.4.gz
/var/log/apport.log.6.gz         /var/log/mysql.log
/var/log/apport.log.7.gz         /var/log/mysql.log.1.gz
/var/log/auth.log                /var/log/mysql.log.2.gz
/var/log/auth.log.1              /var/log/mysql.log.3.gz
/var/log/auth.log.2.gz           /var/log/mysql.log.4.gz
/var/log/auth.log.3.gz           /var/log/mysql.log.5.gz
/var/log/auth.log.4.gz           /var/log/mysql.log.6.gz
/var/log/boot.log                /var/log/mysql.log.7.gz
/var/log/bootstrap.log           /var/log/syslog
/var/log/dpkg.log                /var/log/syslog.1
/var/log/dpkg.log.1              /var/log/syslog.2.gz
/var/log/dpkg.log.10.gz          /var/log/syslog.3.gz
/var/log/dpkg.log.11.gz          /var/log/syslog.4.gz
/var/log/dpkg.log.12.gz          /var/log/syslog.5.gz
/var/log/dpkg.log.2.gz           /var/log/syslog.6.gz
/var/log/dpkg.log.3.gz           /var/log/syslog.7.gz

So what do the numbers indicate? Also what is the difference between log and log.old?

  • 1
    seeing all the logs with a number and compressed suggests that logrotate is doing this for you, check for /etc/logrotate.conf – Centimane Oct 1 '15 at 12:49

Log files indicate different things depending on the application they're for because every application implements logging in their own way. There are some standards that are commonly followed, but there is nothing that forces an application to adhere to any particular logging strategy. So for any given application you should check its man page to try to figure out how it implements logging. After that try google.

The most common practice is to name log files with a .log extension to indicate they are logs. Log files are also commonly placed either in /var/log/ or in the applications install directory.

As for Xorg logs, the number indicates the display number (0 is your first display, 1 should be your second). The .old extension indicates that the log file is for the previous x session.

  • @don_crissti updated my answer – Centimane Oct 1 '15 at 12:38
  • @daltonfury42 for any given application you should check their man page to try to figure out how they implement logging. After that try google. There is no standard as to what a number in a log file means, in x-org's case it's display number, but it's common to place the pid in the file-name (especially for error logs) and in some cases it could even be user implementations (like logrotate). – Centimane Oct 1 '15 at 12:39

Xorg.0.log is the current (most recent) log. Xorg.1.log is the next most recent log.

  • from the xorg man page: -logfile filename Use the file called filename as the Xorg server log file. The default log file is /var/log/Xorg.n.log on most platforms, where n is the display number of the Xorg server. The default may be in a different directory on some platforms. This option is only available when the server is run as root (i.e, with real-uid 0). the number indicates the display. – Centimane Oct 1 '15 at 12:18
  • your answer is wrong. See my comment below Dave's answer. – daltonfury42 Oct 1 '15 at 12:32
  • You are, of course, correct. Brainfart on my part! – fpmurphy Oct 11 '15 at 2:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.