Bluehost Self-Managed VPS and VDS: How to Check System Logs

System logs record events about the state of your server and the processes running on it. Knowing how to access them is important because they can help you solve many problems on your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS).

Notes:

You need SSH or console access to check system logs on your server.
Most troubleshooting and monitoring starts by inspecting the logs for errors or warnings.
If you're logged in as root, you can leave off sudo in the commands below.
These instructions apply to AlmaLinux 8/9/10, Rocky Linux 8/9/10, CentOS Stream 9/10, Fedora, Ubuntu, and Debian.

What Are System Logs?

System logs contain events and messages from the Linux kernel, your web and database servers, security events, and more.
They are your first step in diagnosing problems, finding error messages, and understanding what happened on your server.

Where Logs Are Located

All of the supported distributions use the systemd journal, which you read with journalctl.
Classic log files live in /var/log/ and include syslog, messages, auth.log, and more.
Some apps, such as Apache, Nginx, and MySQL, keep their own logs in /var/log/, for example /var/log/apache2/ or /var/log/nginx/.

Checking Logs With journalctl (systemd Journal)

On all supported distributions, journalctl provides a scrollable, filterable view of your system logs.

Show the latest system logs:

sudo journalctl -xe

Example Output:

Jul 16 10:22:05 vps systemd[1]: Started MySQL Community Server. Jul 16 10:22:05 vps sshd[1503]: Accepted publickey for admin from 203.0.113.10 port 45120 ssh2 Jul 16 10:22:15 vps kernel: EXT4-fs (vda1): re-mounted. Opts: (null) Jul 16 10:22:35 vps systemd[1]: Started A high performance web server and a reverse proxy server.

This opens the logs in a pager. Use the arrow keys to scroll, and press q to exit.

Show all logs since the last boot:

sudo journalctl -b

Follow new log messages in real time (like tail -f):

sudo journalctl -f

Example Output:

Jul 16 10:24:03 vps sshd[1592]: Connection closed by 203.0.113.10 port 45120 Jul 16 10:24:35 vps systemd[1]: Created slice User Slice of UID 0.

Press Ctrl+C to stop following the logs.

Checking Logs in /var/log/ (Classic Log Files)

Important: Docker one-click installs

n8n, Portainer, LEMP, LAMP, and WordPress run in Docker containers. See Checking Logs for Dockerized Apps for their log commands.
GatorClaw, OpenClaw, Magento 2, Claude Code, Moodle, Ollama, Odoo, Hermes Agent, and Paperclip are installed directly, not through Docker. Their logs use the standard commands and files in this section.

Classic Log Files for Native Apps and System Services

General system and application logs

Ubuntu, Debian: /var/log/syslog
AlmaLinux, Rocky Linux, CentOS Stream, Fedora: /var/log/messages

Security and SSH logs

Ubuntu, Debian: /var/log/auth.log
AlmaLinux, Rocky Linux, CentOS Stream, Fedora: /var/log/secure

Web server logs (access and error)

Apache logs:
- Ubuntu, Debian:
  Access logs: /var/log/apache2/access.log
  Error logs: /var/log/apache2/error.log
- AlmaLinux, Rocky Linux, CentOS Stream, Fedora:
  Access logs: /var/log/httpd/access_log
  Error logs: /var/log/httpd/error_log
Nginx logs (all distributions):
Access logs: /var/log/nginx/access.log
Error logs: /var/log/nginx/error.log

View the last 40 lines of the main system logs:

Ubuntu, Debian:

sudo tail -40 /var/log/syslog sudo tail -40 /var/log/auth.log

Example Output:

Jul 16 10:25:10 vps su[1693]: pam_unix(su-l:session): session opened for user admin by root(uid=0) Jul 16 10:25:25 vps sshd[1702]: Failed password for invalid user test from 198.51.100.20 port 35244 ssh2 Jul 16 10:26:03 vps CRON[1723]: (root) CMD (run-parts /etc/cron.hourly)

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo tail -40 /var/log/messages sudo tail -40 /var/log/secure

Example Output:

Jul 16 10:25:10 vps su: pam_unix(su-l:session): session opened for user admin by root(uid=0) Jul 16 10:25:25 vps sshd[1702]: Failed password for invalid user test from 198.51.100.20 port 35244 ssh2 Jul 16 10:26:03 vps systemd: Started Session 31 of user root.

View the last 40 lines of the Apache access and error logs:

Ubuntu, Debian:

sudo tail -40 /var/log/apache2/access.log sudo tail -40 /var/log/apache2/error.log

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo tail -40 /var/log/httpd/access_log sudo tail -40 /var/log/httpd/error_log

View the last 40 lines of the Nginx access and error logs (all distributions):

sudo tail -40 /var/log/nginx/access.log sudo tail -40 /var/log/nginx/error.log

If a Log File Is Missing

Files such as /var/log/syslog, /var/log/auth.log, /var/log/messages, and /var/log/secure are written by a logging service called rsyslog. Fedora doesn't install it by default, and some Debian installations don't either. If you see No such file or directory, you can read the same information with journalctl, or install rsyslog.

Ubuntu, Debian:

sudo apt install rsyslog -y sudo systemctl enable --now rsyslog

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo dnf install rsyslog -y sudo systemctl enable --now rsyslog

The log files are written from that point on. Earlier events remain available through journalctl.

Checking Logs for Dockerized Apps

If your app was installed through a one-click install and runs in Docker (such as n8n, Portainer, LEMP, LAMP, or WordPress), use the following commands.

List all running containers:

sudo docker ps

Example Output:

CONTAINER ID IMAGE NAMES 3c4a2fa9a654 wordpress:... wordpress 53d9cdf733a1 traefik traefik

Use the name in the NAMES column in the commands below. The container names on your server may differ from the examples.

View the most recent logs for a specific container (for example, WordPress):

sudo docker logs --tail 50 wordpress

Example Output:

[Fri Jul 19 ...] AH00558: apache2: Could not reliably determine the server's fully qualified domain name... [Fri Jul 19 ...] [notice] Apache/2.4.54 (Debian) configured -- resuming normal operations

The --tail 50 option shows the last 50 lines. Without it, Docker prints the container's entire log history.

Follow logs in real time (like tail -f):

sudo docker logs -f wordpress

Press Ctrl+C to stop following the logs.

Traefik and Portainer logs:

sudo docker logs --tail 50 traefik sudo docker logs --tail 50 portainer

Useful Log Commands and Tips

Search for error messages quickly:

sudo journalctl | grep -i error

Ubuntu, Debian:

sudo grep -i error /var/log/syslog

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo grep -i error /var/log/messages

Show only logs from a specific service:

sudo journalctl -u nginx sudo journalctl -u sshd

Show logs for today only:

sudo journalctl --since today

Check how much disk space your logs use:

sudo du -sh /var/log

Example Output:

120M /var/log

View logs with less for scrolling and searching:

Ubuntu, Debian:

sudo less /var/log/syslog

AlmaLinux, Rocky Linux, CentOS Stream, Fedora:

sudo less /var/log/messages

Press q to exit less.

Summary

Monitoring the logs on your Bluehost Self-Managed VPS or Virtual Dedicated Server (VDS) helps you troubleshoot problems and keep your server running smoothly. Good places to look include journalctl for system-level logs, /var/log/ for traditional system and app logs, and Docker commands for containerized apps.

Did you find this article helpful?