Ubuntu – Meaning of files in /var/log/lightdm/ and how to properly read lightdm.log file

13.10log

Tracking the slowdowns in the system, I was advised to check the files in the folder /var/log/lightdm/. There I see 4 files as on the image. What logs are recorded in each of them?

The other question is how to properly read file lightdm.log? It's content looks like this

[+0.00s] DEBUG: Logging to /var/log/lightdm/lightdm.log
[+0.00s] DEBUG: Starting Light Display Manager 1.8.4, UID=0 PID=1155
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf.d/10-ubuntu.conf
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf.d/50-greeter-wrapper.conf
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf.d/50-guest-wrapper.conf
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf.d/50-unity-greeter.conf
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf.d/50-xserver-command.conf
[+0.00s] DEBUG: Loading configuration from /etc/lightdm/lightdm.conf
[+0.00s] DEBUG: Using D-Bus name org.freedesktop.DisplayManager
[+0.00s] DEBUG: Registered seat module xlocal
...
[+4.52s] DEBUG: Session pid=1262: Logging to .xsession-errors
[+4.53s] DEBUG: Activating VT 7

Is this file being regenerated each time I log into the desktop? Or data is being appended to the file?

Best Answer

Read this Q&A if you want more info on the boot/login process.

lightdm.log is the log file where your display manager (also called login manager) lightdm write its messages.

After lightdm started the X-server, the X's first and last messages (like a header and a footer) will go into x-N.log, where N represents the display, just like in /var/log/Xorg.N.log which is the log file for the other messages from X.

The x-N-greeter.log file is the log file where the greeter (on ubuntu it is unity-greeter) messages are written, N again represents the display number.

You should start with lightdm.log and read it sequentially, and you will see that is is always reported when and where newer log files are created, e.g.:

[+0.22s] DEBUG: Logging to /var/log/lightdm/lightdm.log
...
[+0.31s] DEBUG: Logging to /var/log/lightdm/x-0.log
...
[+0.87s] DEBUG: Logging to /var/log/lightdm/x-0-greeter.log

Yes, those log files are regenerated on every reboot, but the previous log is saved with the .old suffix.

Related Solutions

Ubuntu – Why not permit read access for all in /var/log

The /var/log files contain logged data, http://tldp.org/LDP/Linux-Filesystem-Hierarchy/html/var.html , important to note-
"/var/log/wtmp, which logs all logins and logouts into the system"
"/var/log/messages, where all kernel and system program message are usually stored"

These areas contain tons of detailed information about your system, and if even read by an outside service, could be used to compromise your whole system. I would advise not to change the permissions on this folder.

Ubuntu – Compression setting for log files in /var/log

/var/log/wtmp is not a text file but it's not compressed either. It's a binary file and to decode it you need a dedicated tool called rawtmp available with the sac package.

sudo apt-get install sac

To access wtmp logs, type in a terminal:

rawtmp | less

Or to decode the first wtmp archive:

rawtmp -w /var/log/wtmp.1 | less

EDIT: To override logrotate compression settings for wtmp you just need to edit the /etc/logrotate.conf file:

sudo gedit /etc/logrotate.conf

To add the nocompress directive:

/var/log/wtmp {
    nocompress
    missingok
    monthly
    create 0664 root utmp
    rotate 12
}

From logrotate man page:

   nocompress
          Old versions of log files are not compressed. See also compress.

Best Answer

Related Solutions

Ubuntu – Why not permit read access for all in /var/log

Ubuntu – Compression setting for log files in /var/log

Related Question