Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the unix equivalent of the Windows Event Log - the tool that logs all processes that start and stop.

Need not be exact - with the whole GUI and everything. Anything close would do.

share|improve this question

This is different for Solaris/Linux:

  • Solaris 10: /var/svc/log/svc.startd.log
  • Linux: /var/log/syslog or /var/log/messages*

*Although most daemons have their own logfiles in /var/log/daemonname/ for example.

share|improve this answer

the /var/log directory is where almost all logs end up. There are graphical tools around to read them, though almost all are admin-friendly text.

share|improve this answer

There is auditd which included many informations like ... who execute what. Also there is syslogd / syslog-ng / rsyslog whcih is being used to monitor syslog event and parse / make actions based on some rules (These rules usually are located on /etc/rsyslog.d or /etc/rsyslog.conf {similar /etc/auditd.conf}).

For GUI you could use logzilla or splunk as free frameworks. (Of course there are many many others)

share|improve this answer

auditd would do your audits (but you will need to configure this). Additionally your "equivilent" of Event Log would ultimately be syslog-ng, which replaces most syslog on most Linux/Unix systems. Furthermore, there is a utility called logrotate on Linux systems that allows you to rotate out your log files on a time/size basis, highly configurable.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.