{"id":1920,"date":"2026-09-12T13:47:29","date_gmt":"2026-09-12T10:47:29","guid":{"rendered":"https:\/\/narhost.com\/destek\/linux-log-dosyalari-nasil-okunur\/"},"modified":"2026-09-12T13:47:29","modified_gmt":"2026-09-12T10:47:29","slug":"linux-log-dosyalari-nasil-okunur","status":"publish","type":"post","link":"https:\/\/narhost.com\/destek\/linux-log-dosyalari-nasil-okunur\/","title":{"rendered":"Linux Sunucu Log Dosyalar\u0131 Nerede, Nas\u0131l Okunur (journalctl, \/var\/log)"},"content":{"rendered":"<p class=\"kb-dogrulama\">Son do\u011frulama: Eyl\u00fcl 2026 \u00b7 Ubuntu 24.04 test sunucusunda denendi<\/p>\n<div id=\"hizli-cozum\" class=\"ai-box ai-box--cozum\">\n<p class=\"ai-box-title\">H\u0131zl\u0131 \u00e7\u00f6z\u00fcm<\/p>\n<p><strong>Linux log dosyalar\u0131 nas\u0131l okunur<\/strong> sorusunun cevab\u0131 iki katmandad\u0131r: systemd tabanl\u0131 sunucularda <code>journalctl<\/code> ile ikili g\u00fcnl\u00fc\u011f\u00fc, klasik yap\u0131da <code>\/var\/log<\/code> dizinindeki metin dosyalar\u0131n\u0131 okursunuz. \u00d6nce hangi servisin izini arad\u0131\u011f\u0131n\u0131z\u0131 belirleyin, sonra do\u011fru komutu se\u00e7in.<\/p>\n<ol>\n<li>Genel duruma bak\u0131n: <code>journalctl --disk-usage<\/code><\/li>\n<li>G\u00fcncel \u00f6ny\u00fcklemenin kay\u0131tlar\u0131n\u0131 g\u00f6r\u00fcn: <code>journalctl -b --no-pager<\/code><\/li>\n<li>Yaln\u0131z hatalar\u0131 filtreleyin: <code>journalctl -p err -b<\/code><\/li>\n<li>Klasik metin dosyas\u0131n\u0131 okuyun: <code>tail -n 50 \/var\/log\/auth.log<\/code><\/li>\n<\/ol>\n<\/div>\n<table class=\"kb-uyg\">\n<tr>\n<th>Panel<\/th>\n<td>Yok (SSH \/ terminal)<\/td>\n<\/tr>\n<tr>\n<th>Sistem<\/th>\n<td>Ubuntu 22.04\/24.04, Debian 12, AlmaLinux 8\/9 (VPS\/VDS)<\/td>\n<\/tr>\n<tr>\n<th>Yetki<\/th>\n<td>sudo\/root (baz\u0131 dosyalar i\u00e7in <code>adm<\/code> grubu yeterli)<\/td>\n<\/tr>\n<tr>\n<th>Narhost \u00fcr\u00fcn\u00fc<\/th>\n<td><a href=\"https:\/\/narhost.com\/vps-sunucu\" title=\"VPS Sunucu - Narhost\">VPS Sunucu<\/a>, VDS Sunucu<\/td>\n<\/tr>\n<\/table>\n<div class=\"kb-once\">\n<p class=\"label\">Ba\u015flamadan \u00f6nce<\/p>\n<ul>\n<li>Sunucunuza SSH ile ba\u011flanabiliyor olmal\u0131s\u0131n\u0131z; ilk ba\u011flant\u0131y\u0131 hen\u00fcz kurmad\u0131ysan\u0131z \u00f6nce <a href=\"https:\/\/narhost.com\/destek\/vps-vds-ilk-kurulum-rehberi\/\" title=\"VPS VDS Sunucu \u0130lk Kurulum Rehberi - Narhost Destek\">VPS\/VDS ilk kurulum rehberini<\/a> tamamlay\u0131n.<\/li>\n<li>Kimlik do\u011frulama kay\u0131tlar\u0131 genelde <code>root<\/code> ya da <code>adm<\/code> grubuna a\u00e7\u0131kt\u0131r; kendi kullan\u0131c\u0131n\u0131zla okuyam\u0131yorsan\u0131z komutun ba\u015f\u0131na <code>sudo<\/code> ekleyin.<\/li>\n<li>\u015eik\u00e2yetin geldi\u011fi yakla\u015f\u0131k saati not edin; log dosyalar\u0131 h\u0131zla b\u00fcy\u00fcr ve eski sat\u0131rlar rotate ile d\u00f6ner.<\/li>\n<\/ul>\n<\/div>\n<h2>Linux log dosyalar\u0131 nas\u0131l okunur, neden gerekir<\/h2>\n<p>Bir servis \u00e7\u00f6kmesi, ba\u015far\u0131s\u0131z giri\u015f denemesi ya da beklenmeyen yeniden ba\u015flatma ya\u015fand\u0131\u011f\u0131nda sunucunun ne yapt\u0131\u011f\u0131n\u0131 yaln\u0131zca log dosyalar\u0131 anlat\u0131r. systemd kullanan g\u00fcncel da\u011f\u0131t\u0131mlarda (Ubuntu, Debian, AlmaLinux, Rocky) \u00e7ekirdek, servis ve oturum kay\u0131tlar\u0131n\u0131n \u00e7o\u011fu <code>journalctl<\/code> komutuyla okunan ikili bir g\u00fcnl\u00fckte (journal) tutulur; komutun t\u00fcm se\u00e7enekleri <a href=\"https:\/\/man7.org\/linux\/man-pages\/man1\/journalctl.1.html\" title=\"journalctl resmi man sayfas\u0131 (man7.org)\" target=\"_blank\" rel=\"noopener\">journalctl&#8217;in resmi man sayfas\u0131nda<\/a> listelenir. Bunun yan\u0131nda eski yap\u0131dan kalan servisler kay\u0131tlar\u0131 h\u00e2l\u00e2 <code>\/var\/log<\/code> alt\u0131nda d\u00fcz metin dosyalar\u0131na da yazar; bu dosyalar <code>tail<\/code> ve <code>grep<\/code> ile filtrelenir.<\/p>\n<p>\u0130ki katman\u0131n birlikte var olmas\u0131n\u0131n pratik bir sonucu vard\u0131r: bir sorunu ararken tek bir yere bakmak yetmez. \u00d6rne\u011fin ba\u015far\u0131s\u0131z SSH giri\u015fleri Ubuntu ve Debian&#8217;da <code>\/var\/log\/auth.log<\/code>, AlmaLinux ve RHEL ailesinde <code>\/var\/log\/secure<\/code> dosyas\u0131na yaz\u0131l\u0131r; ayn\u0131 kay\u0131tlar \u00e7o\u011fu zaman <code>journalctl<\/code> \u00fczerinden de okunabilir. Hangi yolu se\u00e7ece\u011finiz, o servisin sunucunuzda journal&#8217;a m\u0131 yoksa do\u011frudan dosyaya m\u0131 yazd\u0131\u011f\u0131na ba\u011fl\u0131d\u0131r.<\/p>\n<figure class=\"nh-sema\"><img src=\"https:\/\/narhost.com\/destek\/wp-content\/uploads\/2026\/09\/linux-log-dosyalari-nasil-okunur-sema-narhost.webp\" alt=\"Linux log dosyalar\u0131 nas\u0131l okunur ak\u0131\u015f \u015femas\u0131: disk kullan\u0131m\u0131, \u00f6ny\u00fckleme kayd\u0131, hata filtresi, metin log dosyas\u0131, arama\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>Linux log dosyalar\u0131 nas\u0131l okunur be\u015f ad\u0131mda \u00f6zetlenir: durum, \u00f6ny\u00fckleme kayd\u0131, hata filtresi, metin dosyas\u0131, arama.<\/figcaption><\/figure>\n<h2>Log dosyalar\u0131n\u0131 ad\u0131m ad\u0131m okuma<\/h2>\n<ol class=\"kb-adimlar\">\n<li><strong>Log alan\u0131n\u0131n ne kadar yer kaplad\u0131\u011f\u0131n\u0131 g\u00f6r\u00fcn.<\/strong> Sorun gidermeden \u00f6nce kay\u0131tlar\u0131n ne zamandan ba\u015flad\u0131\u011f\u0131n\u0131 bilmek i\u015finize yarar.\n<pre><code class=\"language-bash\">journalctl --disk-usage<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: &#8220;Archived and active journals take up X.XM in the file system.&#8221; sat\u0131r\u0131; test sunucusunda bu de\u011fer 8,0M \u00e7\u0131kt\u0131.<\/p>\n<\/li>\n<li><strong>G\u00fcncel \u00f6ny\u00fcklemenin (boot) kay\u0131tlar\u0131na bak\u0131n.<\/strong><code>-b<\/code> bayra\u011f\u0131 yaln\u0131zca sunucunun son a\u00e7\u0131l\u0131\u015f\u0131ndan beri olu\u015fan kay\u0131tlar\u0131 g\u00f6sterir, <code>--no-pager<\/code> \u00e7\u0131kt\u0131y\u0131 sayfalama olmadan do\u011frudan terminale basar.\n<pre><code class=\"language-bash\">journalctl -b --no-pager | tail -n 30<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: zaman damgas\u0131, sunucu ad\u0131, servis ad\u0131 ve mesaj\u0131n yer ald\u0131\u011f\u0131 sat\u0131rlar listelenir; test sunucusunda son sat\u0131rlar <code>systemd[\u2026]: Reached target sockets.target - Sockets.<\/code> gibi servis ba\u015flatma kay\u0131tlar\u0131yd\u0131.<\/p>\n<\/li>\n<li><strong>Yaln\u0131zca hatalar\u0131 filtreleyin.<\/strong> Y\u00fczlerce bilgi sat\u0131r\u0131 aras\u0131nda kaybolmamak i\u00e7in \u00f6nem seviyesine g\u00f6re s\u00fcz\u00fcn; <code>err<\/code> systemd&#8217;nin \u00f6ncelik seviyelerinden biridir.\n<pre><code class=\"language-bash\">journalctl -p err -b --no-pager<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: yaln\u0131zca hata seviyesindeki sat\u0131rlar kal\u0131r; test sunucusunda bu komut bir SSH protokol uyar\u0131s\u0131 ve bir MariaDB kurulum uyar\u0131s\u0131 d\u00f6nd\u00fcrd\u00fc, bilgi sat\u0131rlar\u0131n\u0131n tamam\u0131 elendi.<\/p>\n<\/li>\n<li><strong>Klasik metin log dosyalar\u0131n\u0131 listeleyin ve okuyun.<\/strong><code>\/var\/log<\/code> dizini hem g\u00fcncel hem s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f eski (<code>.gz<\/code>) dosyalar\u0131 tutar.\n<pre><code class=\"language-bash\">ls -la \/var\/logtail -n 30 \/var\/log\/auth.log<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: dizinde <code>auth.log<\/code>, <code>syslog<\/code>, <code>dmesg<\/code>, <code>btmp<\/code> gibi dosyalar g\u00f6r\u00fcn\u00fcr; <code>tail<\/code> son sat\u0131rlar\u0131 oldu\u011fu gibi listeler.<\/p>\n<\/li>\n<li><strong>Belirli bir ifadeyi aray\u0131n.<\/strong> Uzun bir dosyada tek bir olay\u0131 bulmak i\u00e7in <code>grep<\/code> kullan\u0131n; <code>-i<\/code> b\u00fcy\u00fck\/k\u00fc\u00e7\u00fck harf ayr\u0131m\u0131n\u0131 kapat\u0131r.\n<pre><code class=\"language-bash\">grep -i \"fail\" \/var\/log\/auth.log | tail -n 10<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: e\u015fle\u015fen sat\u0131rlar listelenir; test sunucusunda bu komut \u00f6rnek bir adresten (203.0.113.45) gelen &#8220;Failed password for invalid user admin&#8221; sat\u0131r\u0131n\u0131 g\u00f6sterdi \u2014 otomatik tarama giri\u015fimlerinin tipik izidir.<\/p>\n<\/li>\n<li><strong>\u00c7ekirdek ve donan\u0131m mesajlar\u0131na bak\u0131n.<\/strong> Disk, a\u011f kart\u0131 ya da bellek ile ilgili d\u00fc\u015f\u00fck seviyeli olaylar burada birikir.\n<pre><code class=\"language-bash\">dmesg | tail -n 30<\/code><\/pre>\n<p class=\"kb-cikti\">Beklenen sonu\u00e7: \u00e7ekirdek zaman damgas\u0131yla ba\u015flayan sat\u0131rlar; test sunucusunda AppArmor&#8217;un bir arka plan s\u00fcrecini k\u0131s\u0131tlad\u0131\u011f\u0131n\u0131 bildiren &#8220;DENIED&#8221; sat\u0131rlar\u0131 g\u00f6r\u00fcld\u00fc.<\/p>\n<\/li>\n<\/ol>\n<h2>Do\u011frulama<\/h2>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>Arad\u0131\u011f\u0131n\u0131z olay\u0131n yakla\u015f\u0131k zaman\u0131n\u0131 not edin ve ayn\u0131 aral\u0131\u011f\u0131 hem <code>journalctl --since \"10 dakika \u00f6nce\"<\/code> hem de ilgili <code>\/var\/log<\/code> dosyas\u0131nda <code>grep<\/code> ile aray\u0131n; iki kaynakta da ayn\u0131 olay\u0131 g\u00f6r\u00fcyorsan\u0131z te\u015fhis do\u011frudur.<\/p>\n<\/div>\n<h2>H\u00e2l\u00e2 \u00e7\u00f6z\u00fclmediyse<\/h2>\n<ul>\n<li><strong>journalctl &#8220;No journal files were found&#8221; veriyor.<\/strong> Sunucu kal\u0131c\u0131 (persistent) g\u00fcnl\u00fck saklam\u0131yor olabilir; sorun devam eden bir servisle ilgiliyse <code>\/var\/log<\/code> alt\u0131ndaki dosyaya bak\u0131n.<\/li>\n<li><strong>\/var\/log dizini beklenenden k\u00fc\u00e7\u00fck, eski kay\u0131t yok.<\/strong> logrotate periyodik olarak eski dosyalar\u0131 s\u0131k\u0131\u015ft\u0131r\u0131p yeniden ba\u015flat\u0131r; <code>.gz<\/code> uzant\u0131l\u0131 dosyalar\u0131 da kontrol edin.<\/li>\n<li><strong>Sunucu genel olarak yava\u015f ama loglarda net bir hata yok.<\/strong> Kaynak t\u00fcketimini <a href=\"https:\/\/narhost.com\/destek\/top-htop-ile-kaynak-izleme\/\" title=\"top ve htop ile kaynak izleme - Narhost Destek\">top\/htop ile kaynak izleme<\/a> kart\u0131ndaki ad\u0131mlarla kontrol edin.<\/li>\n<\/ul>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost deste\u011fi<\/p>\n<p>Destek talebinize sunucunuzun i\u015fletim sistemini, inceledi\u011finiz log dosyas\u0131n\u0131 ya da <code>journalctl<\/code> filtresini, olay\u0131n yakla\u015f\u0131k saatini ve g\u00f6rd\u00fc\u011f\u00fcn\u00fcz tam hata sat\u0131r\u0131n\u0131 ekleyin.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/submitticket.php\" title=\"Narhost destek talebi a\u00e7\">Destek talebi a\u00e7<\/a><\/div>\n<div class=\"kb-ilgili\">\n<p class=\"label\">Sonraki ad\u0131mlar<\/p>\n<ul>\n<li><a href=\"https:\/\/narhost.com\/destek\/vps-vds-ilk-kurulum-rehberi\/\" title=\"VPS VDS Sunucu \u0130lk Kurulum Rehberi - Narhost Destek\">VPS\/VDS Sunucu \u0130lk Kurulum Rehberi<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/destek\/top-htop-ile-kaynak-izleme\/\" title=\"top ve htop ile kaynak izleme - Narhost Destek\">top\/htop ile Kaynak \u0130zleme<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/destek\/linux-sunucuda-disk-kullanimi-nasil-denetlenir\/\" title=\"Linux sunucuda disk kullan\u0131m\u0131 nas\u0131l denetlenir - Narhost Destek\">Linux Sunucuda Disk Kullan\u0131m\u0131 Nas\u0131l Denetlenir<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/destek\/linux-servisini-durdurma-ve-aktif-etme\/\" title=\"Linux servisini durdurma ve aktif etme - Narhost Destek\">Linux Servisini Durdurma ve Aktif Etme<\/a><\/li>\n<li><a href=\"https:\/\/narhost.com\/destek\/vds-aldim-ama-kasiyor-ne-yapmaliyim\/\" title=\"VDS ald\u0131m ama kas\u0131yor ne yapmal\u0131y\u0131m - Narhost Destek\">VDS Ald\u0131m Ama Kas\u0131yor, Ne Yapmal\u0131y\u0131m<\/a><\/li>\n<\/ul>\n<\/div>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>journalctl \u00e7\u0131kt\u0131s\u0131 \u00e7ok uzun, nas\u0131l daralt\u0131r\u0131m?<\/h3>\n<p><code>-b<\/code> ile son \u00f6ny\u00fcklemeye, <code>-p err<\/code> ile hata seviyesine, <code>--since<\/code>\/<code>--until<\/code> ile belirli bir zaman aral\u0131\u011f\u0131na indirin; bu bayraklar\u0131 birlikte de kullanabilirsiniz.<\/p>\n<h3>\/var\/log dosyalar\u0131 neden zamanla k\u00fc\u00e7\u00fcl\u00fcyor ya da .gz oluyor?<\/h3>\n<p>logrotate servisi belirli bir boyuta ya da s\u00fcreye ula\u015fan dosyalar\u0131 s\u0131k\u0131\u015ft\u0131r\u0131p yenisini a\u00e7ar; eski kay\u0131tlar kaybolmaz, <code>.gz<\/code> uzant\u0131l\u0131 dosyalarda saklan\u0131r.<\/p>\n<h3>Payla\u015f\u0131ml\u0131 hostingde bu komutlar\u0131 \u00e7al\u0131\u015ft\u0131rabilir miyim?<\/h3>\n<p>Hay\u0131r, payla\u015f\u0131ml\u0131 hostingde SSH eri\u015fimi yoktur. Bu y\u00f6ntem yaln\u0131zca kendi sunucunuz olan VPS ve VDS \u00fcr\u00fcnlerinde \u00e7al\u0131\u015f\u0131r.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Linux log dosyalar\u0131 nas\u0131l okunur: systemd sunucularda journalctl ile ikili g\u00fcnl\u00fck, klasik da\u011f\u0131t\u0131mlarda \/var\/log dizinindeki metin dosyalar\u0131 tail ve grep ile okunur; ad\u0131m ad\u0131m sorun giderme y\u00f6ntemi.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,13],"tags":[],"class_list":["post-1920","post","type-post","status-publish","format-standard","hentry","category-vds-server","category-vps-server"],"meta_box":[],"_links":{"self":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts\/1920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/comments?post=1920"}],"version-history":[{"count":0,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/posts\/1920\/revisions"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/media?parent=1920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/categories?post=1920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/destek\/wp-json\/wp\/v2\/tags?post=1920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}