How to Log Debug Messages with rsyslog and journald

Updated: 28 September 2026 · Applies to: rsyslog 8.2x and systemd-journald on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13

By default, /var/log/messages (AlmaLinux, Rocky Linux, RHEL) and /var/log/syslog (Ubuntu) leave out the least important messages, the "debug" level. When you troubleshoot, you may want to see more. On current systems, messages pass through the systemd journal first, which already keeps everything, and rsyslog then writes a filtered copy to the text files.

The quickest way: read the journal

journalctl -p debug -b         # every message of this boot, including debug
journalctl -u nginx -p debug   # one service

journald stores all levels by default, so no configuration change is needed for this.

Write debug messages to a separate file

1. Create /etc/rsyslog.d/90-debug.conf:

   *.debug    /var/log/debug.log

   This writes messages of every level, from every source, to /var/log/debug.log. To limit it to one facility, use for example mail.debug or local3.debug.
2. Check and restart:

   rsyslogd -N1
   systemctl restart rsyslog

3. Test: logger -p user.debug "debug test", then tail /var/log/debug.log.
4. Add the file to log rotation, or it grows without limit: add a line with /var/log/debug.log to the list in /etc/logrotate.d/rsyslog (AlmaLinux, Rocky Linux, RHEL) or create your own logrotate file.

Remove the file in /etc/rsyslog.d/ and restart rsyslog when you are done: debug logging can produce a lot of data.

Change the level of the main log file

On AlmaLinux, Rocky Linux and RHEL, /etc/rsyslog.conf contains a line starting with *.info;mail.none;authpriv.none;cron.none for /var/log/messages. Changing *.info to *.debug includes debug messages there. A separate file, as above, is easier to switch off again.

More detail from one program

The level a program logs at is set in the program, not in rsyslog. Examples: LogLevel VERBOSE in sshd_config, or a log_level or debug option in many other daemons. Check that program's documentation. (The systemd setting LogLevelMax can only reduce what is kept, not add detail.)

Debugging rsyslog itself

If rsyslog does not write what you expect, check its configuration with rsyslogd -N1, and look at its own messages with journalctl -u rsyslog.

Official documentation: rsyslog filter conditions and journald.conf.