Let us list the contents of /etc, /usr/bin, /home, and /opt. What can you notice about /etc compared to /usr/bin? We can see that there are programs in /usr/bin and /etc that has directories and those contain text files with configuration data.
The less command
There is another useful way to display the contents of a file, with the less command. This comes in handy when you want to display text files that are longer than one page, as you can scroll down and up in the file with the Pg Down and Pg Up keys. Let’s try this with a file that is usually very long, the log file messages. This contains global system messages and is located in /var/log. To display it, type less /var/log/syslog.
Here we will limit ourselves to the syslog and dpkg.log files. This file is the log file for all installations, upgrades, removals and purges of applications on a Debian-based Linux distribution.
Logging is a vital aspect of Linux to understand how everything fits together and these two logs give you an excellent starting point to piece together how Linux works. Now let’s check out the available and used disk space in our Linux installation.
Check the available disk space
df -h will display the used disk space. Let’s go over the output from this command.
- The left-most column shows the name of a logical volume.
- After that, you see the allocated size for that volume, also known as available space.
- This is followed by a number indicating how much space is used, as well as a column showing the usage in percent.
- The last column denotes the physical mount location on the hard drive.
- You should become used to monitoring log files in the future. Of course, you don’t want to do this manually, but it’s important to know where you can find log messages for different issues.
Let’s take a look at log files in Linux
The starting point for system and application log files is the /var/log directory. Let’s look at two log files, the main system, and application log as well as the log file for the Debian package manager.
syslog
Syslog is used by many devices and applications to handle logging. All their log messages are stored in the syslog log file and can be tracked using facility codes to distinguish where messages come in from.
This is also the general system for storing application logs. Syslog separates applications that generate messages, the system that stores them, and the software that reports the log messages.
Keep in mind that it is up to applications to specify that they will use syslog for logging. Therefore, you can expect different (or lacking) application usage of syslog to report application behavior. It is really up to the developer how to integrate their application with syslog.
dpkg.log on Debian systems
This is the log file for the Debian package manager (the program is also called dpkg). Whereas the binary dpkg installs .deb packages that have to be explicitly entered on the command line, apt-get can find and install packages from multiple sources. For the latter, we use apt-cache to search for packages.
Since we found the file dpkg.log, let’s look at commands that work with the Debian package management So let’s get acquainted with dpkg, apt-get and apt-cache.
When you install a new .deb package with the dpkg program, the dpkg.log will be appended with lines that describe the operation. Similarly, when you use apt-get to install a package, the lines for the operation will also be added to dpkg.
The crucial difference between dpkg and apt-get is that dpkg requires specific .deb files, whereas apt-get takes a package name that is recognized in a central repository and mapped to the necessary installation files. This simplifies the installation of software as apt-get will resolve dependencies between separate binaries – A piece of software can depend on several other binaries (other programs).
Let’s install an application
Let’s see how to install an application in action. First, we will install a package using apt-get. As we are not sure about the name, we will do a free text search with the program apt-cache to search the package cache where programs are stored. We want a powerful process monitor so we can monitor running programs in real-time. We know that there is the top command, but aren’t there any alternatives? For the sake of illustration, let’s just search for top and see what comes up.
apt-cache search top
We received +3000 hits. Let’s filter this with grep. Remember that grep can be used to filter output, this is possible with output from any program.
apt-cache search top | grep process
40+ results, that is more readable! Browse the list and you should see the following:
htop – interactive processses viewer
You use”grep” often to filter output from other commands
When you work on the commandline and expect large amount of output, you might want to filter it. For that we use the grep command that filters for free text . In the case above, we filtered the output from apt-cache to match lines that contain the word “process”. The more you work with Linux, the more you will see how grep can assist you with limiting the output data from commands.
Installing htop
Let’s install htop with the APT package handling utility, apt-get.
apt-get install htop
You should see several messages flashing past on the command line. If you get a message similar to the following then you have to either a) change to root, or b) run the command with sudo to execute the command with elevated privileges. The package is now installed and you should be able to run it. Type in htop and press Enter. You should see a colorful process monitor.
dpkg.log in Debian Linux distributions
Now, let’s take a look at the log file dpkg.log. Use cat or less to view the contents of the file. Can you locate the statements that relate to our installed package htop?
As this was the last installed package you should see the related lines at the end of the file, with datestamps indicating the exact time of the installation of dependencies.
If we had installed an application using dpkg we would see lines added in the same log file dpkg.log.
Let’s turn our attention to the syslog file instead. Let’s open the file with less so you can scroll up and down in the file. You will see messages that originate from several different sources. For now, you should be aware that this is a good place to start when you are looking for general system messages.
Knowledge Check!
Thanks for completing this lesson. This one has introduced several new concepts such as installation of software and Linux system logging. These are large concepts and are necessary as the foundation for becoming a savvy Linux user.
Let us move on to lesson six, “Who are you and what’s running on this Linux box anyway?“. To access the remaining lessons, you need to register on this website.