Where are the logs? Every log on a PHP server, and what each one tells you

First: the journal

Most services write to systemd's journal. On Debian 12 and 13 it's often the only place: since Debian 12, the old rsyslog service isn't installed by default, so there's no /var/log/syslog or /var/log/auth.log. Ubuntu 24.04 still has both. The journal works on both:

sudo journalctl -u nginx -n 50 --no-pager     # one service, last 50 lines
sudo journalctl -u ssh --since "1 hour ago"   # since a time
sudo journalctl -u php8.4-fpm -f              # follow live, Ctrl+C to stop
sudo journalctl -k                            # kernel: out-of-memory kills, disk errors

On our test server, the journal was kept on disk (/var/log/journal), so it survives a reboot. See how much space it uses with journalctl --disk-usage.

The web server

• Nginx: /var/log/nginx/error.log and access.log, unless a site sets its own error_log or access_log in its server block. Check with sudo grep -Rn "_log" /etc/nginx/sites-enabled/.
• Apache: /var/log/apache2/error.log, access.log and other_vhosts_access.log (sites without their own log).

The error log is the first place for 4xx and 5xx problems: 502 and 504, 403 and "File not found", 413 upload errors. If Nginx won't start, see Nginx won't start or reload.

PHP

• PHP errors from your sites (fatal errors, warnings): with Debian's and Ubuntu's default settings, they end up in the web server's error log, as lines starting with FastCGI sent in stderr: "PHP message: .... We saw this in every PHP test for our guides.
• PHP-FPM itself (pools starting, workers crashing, "max_children reached", slow requests): /var/log/php8.4-fpm.log.
• The slow log, if you turn it on: wherever its slowlog line points. See server slow? find which site and page.

Useful searches: grep "PHP Fatal" /var/log/nginx/error.log and grep "Allowed memory size" /var/log/nginx/error.log (see the memory guide).

Your app

• Laravel: storage/logs/laravel.log in the app's folder. If it stays empty while the site shows errors, check that the web server can write to it: see Laravel 500 errors.
• WordPress: nothing by default. Turn on WP_DEBUG_LOG with a path outside the website's folder, as shown in the database connection guide. For fatal errors, the web server's log already has them: see WordPress critical errors.

The database

• MariaDB on Debian and Ubuntu: in the journal (sudo journalctl -u mariadb). The log_error line in /etc/mysql/mariadb.conf.d/50-server.cnf is commented out by default, so there's no separate file unless you turn it on.
• MySQL: usually /var/log/mysql/error.log.
• Slow queries: only if you turn on the slow query log. See finding slow database queries.

If the database won't start, see MariaDB or MySQL won't start. If sites can't reach it, see "Error establishing a database connection".

Logins, SSH and sudo

• SSH: sudo journalctl -u ssh (on Ubuntu also /var/log/auth.log). Failed logins, refused keys and OpenSSH's penalty blocks are here. See can't log in with SSH.
• Who logged in: last (successful logins) and sudo lastb (failed ones). They read /var/log/wtmp and /var/log/btmp.
• sudo: sudo journalctl -t sudo. See who logged in and what they did with sudo.
• Fail2ban: /var/log/fail2ban.log, for bans and unbans.

Scheduled jobs, updates and certificates

• Cron: sudo journalctl -u cron. Cron doesn't save your job's output: see why your cron job isn't running.
• Package installs and updates: /var/log/apt/history.log (what was installed, when, and by which command) and /var/log/dpkg.log.
• Automatic security updates: /var/log/unattended-upgrades/. See automatic security updates.
• Certificates: /var/log/letsencrypt/letsencrypt.log. Certbot creates it the first time it runs. See HTTPS certificate renewal.

The whole server

• Out of memory: sudo journalctl -k | grep -i "killed process". See out-of-memory errors and swap.
• Everything around a time: sudo journalctl --since "2026-11-13 09:00" --until "2026-11-13 09:15" shows all services together, which helps when you know when the problem started.
• Logs filling the disk: see stop logs filling the disk.

Quick list

• Site errors (4xx, 5xx, PHP errors): /var/log/nginx/error.log or /var/log/apache2/error.log.
• PHP-FPM: /var/log/php8.4-fpm.log.
• Database, SSH, cron, any service: journalctl -u name.
• Laravel: storage/logs/laravel.log. WordPress: turn on WP_DEBUG_LOG.
• Updates: /var/log/apt/history.log. Certificates: /var/log/letsencrypt/.
• No /var/log/syslog or auth.log on Debian? That's normal since Debian 12. Use journalctl.

Official sources

• Debian 12 release notes, "Changes to system logging" (rsyslog no longer installed by default)
• journalctl manual (Debian 13)
• Nginx: error_log and PHP-FPM settings

Next steps: new server? Start with the security checklist for a PHP server.

ServerNest is being built to bring each site's important log lines into one dashboard, so you don't have to know where they all live. Join early access to try it first.

← Back to the security blog