Practice Use drills for recall and labs for real operating judgment.

LAB-FS-03 - Inside /var - The Living Data

Inspect /var safely so you can find changing data such as logs and understand how to read it without making the situation worse.

FS File System Mastery

Inside /var - The Living Data

Inspect /var safely so you can find changing data such as logs and understand how to read it without making the situation worse.

45 min INTERMEDIATE LINUX Field-verified
Prerequisites
Lab LAB-FS-01 - The Linux File System Tree
Success criteria
  • Find likely log locations under /var.
  • Use tail, less, or journalctl to inspect recent activity safely.
Safety notes
  • Do not edit log files directly. Read them with tail, less, or journalctl.

Part A: The Field Guide

/var holds data that changes while the system runs. For most learners, the most important part is /var/log.

When a service fails, your job is usually not to guess. Your job is to inspect the latest evidence.

Safe Reading Rule

Use tail, less, or journalctl to inspect logs. Avoid opening active logs in an editor while you are still learning.

What to expect under /var

  • /var/log for system and application logs
  • /var/lib for persistent application data
  • /var/spool for queued work waiting to be processed

Part B: The Drill Deck

Terminal required: you may need sudo for some logs depending on your distribution.

G
Guided Step by step - type exactly this and compare the result
>

Exercise G1: Find the log area

  1. Run cd /var/log
  2. Run ls | head
  3. Notice the variety of logs and service-specific folders

Exercise G2: Read only the recent lines

  1. Run one of these, depending on your system: sudo tail -n 20 /var/log/syslog sudo tail -n 20 /var/log/messages
  2. Look at the latest timestamps
  3. Explain what tail is helping you avoid

Exercise G3: Page through a larger log

  1. Run one of these: sudo less /var/log/syslog sudo less /var/log/messages
  2. Search inside the log with /error
  3. Press n to move to the next match and q to quit
S
Solo Task described, hints available - figure it out
>

Exercise S1: Follow live updates

  1. Run one of these commands and leave it open: sudo tail -f /var/log/syslog sudo tail -f /var/log/messages
  2. In another terminal, run logger "practice message"
  3. Watch the new line appear
  4. Stop the follow session with Ctrl+C

Exercise S2: Try journalctl

  1. Run journalctl -n 20
  2. Then run journalctl -f
  3. Compare the experience with tail -f
M
Mission Real scenario - no hints, combine multiple skills
>

Mission M1: Choose the right reading tool

For each situation below, name the tool you would use first and why:

  1. You want only the most recent lines.
  2. You want to search through a long log calmly.
  3. You are on a system where journalctl is the main source of service logs.

If you can choose the reader based on the task, you are learning the part that actually matters.