How to filter out errors in Ubunty system log files?

Question

How to find errors in Ubunty system log files, in particular, errors that can cause various problems and proving that system is damaged, not small arbitrary errors. I mean search for lines with error, corrupted, failed, crash messages in log files. Which log files is most important? I installed Glogg log explorer utility. Is there method to scan multiple log files and filter out important error messsages to separate file for analysis?

Solution 1

The simplest way to do this is by using grep in a terminal window. The log file you should check first, is syslog. So, typing:

grep -i -e fail -e error -e corrupt /var/log/syslog

would give you all the lines that contain the key words you type after each -e switch. The -i switch tells grep to ignore case.

Solution 2

Nowadays on an Ubuntu system with journald, you can actually filter all logs by priority based on metadata, rather than by looking for text strings that might (or might not) imply the priority.

Use journalctl to display logs. It has many filtering options, but the one to find errors is this:

-p, --priority=
           Filter output by message priorities or priority ranges. Takes either a single numeric or textual log level (i.e. between
           0/"emerg" and 7/"debug"), or a range of numeric/text log levels in the form FROM..TO. The log levels are the usual syslog
           log levels as documented in syslog(3), i.e.  "emerg" (0), "alert" (1), "crit" (2), "err" (3), "warning" (4), "notice" (5),
           "info" (6), "debug" (7). If a single log level is specified, all messages with this log level or a lower (hence more
           important) log level are shown. If a range is specified, all messages within the range are shown, including both the start
           and the end value of the range. This will add "PRIORITY=" matches for the specified priorities.

So if you want to search all logs for anything classified as Emergency, Alert, Critical, or Error (these are the 4 most severe levels), then use:

journalctl -p 0..3

Comments

[minto]

grep is easy, well. What's other important log files that need to be checked first?