Replacement of /var/log/syslog by journalctl in Debian 12

Since Debian 12, the Syslog is replaced by journalctl. This change marks the end of a transition from traditional log files to systemd-journald daemons, which began with Debian 8 (Jessie).

Replacement of Syslog

Under Debian 12 Bookworm, you will quickly notice that a Syslog (/var/log/syslog) is missing.

tk@js-debian12-01:~$ cat /var/log/syslog
cat: /var/log/syslog: file or register not found

The reason for this is the change in Debian 12 Base-OS that replaces the Syslog by journalctl.

Usage of journalctl

Some examples for the usage of journalctl :

• journalctl: displays the system protocol.
• journalctl -f: follows the system log in real time, similar to tail -f /var/log/syslog.
• journalctl -u servicename: displays the protocol for a certain systemd-service, for example journalctl -u systemd-timesyncd
• journalctl -b: displays the protocol for the last booting process.
• journalctl --since=yesterday: displays the protocol since yesterday
  • --since supports the specifications of the timestamp parameters Jun 28 11:47:07

journalctl offers many more options that can be viewed with man journalctl .

Author: Jonas Sterr Jonas Sterr has been working for Thomas-Krenn for several years. Originally employed as a trainee in technical support and then in hosting (formerly Filoo), Mr. Sterr now mainly deals with the topics of storage (SDS / Huawei / Netapp), virtualization (VMware, Proxmox, HyperV) and network (switches, firewalls) in product management at Thomas-Krenn.AG in Freyung.

Translator: Alina Ranzinger Alina has been working at Thomas-Krenn.AG since 2024. After her training as multilingual business assistant, she got her job as assistant of the Product Management and is responsible for the translation of texts and for the organisation of the department.