Where installed apps store logs on Linux
/var/log, the journal, and the XDG directories a desktop application writes under, including where Snap and Flatpak put the same file instead.
Linux splits cleanly in two. Anything that runs as a service logs to the system - /var/log, or the systemd journal. Anything that runs as you logs under your home directory, in one of three XDG locations that are frequently confused for each other. Packaging then moves the second half again.
System logs: /var/log and the journal
/var/log is the traditional home, one directory or file per service. Nginx writes /var/log/nginx/error.log; PostgreSQL writes /var/log/postgresql/postgresql-<version>-main.log on Debian and Ubuntu but /var/lib/pgsql/<version>/data/log/ on Red Hat family distributions, which is the single most common reason a path copied off a forum does not exist on your machine.
Applications that ship their own directory layout rather than the distribution’s ignore /var/log entirely. Apache Tomcat writes to $CATALINA_BASE/logs/catalina.out, whereverCATALINA_BASE happens to point.
On any systemd distribution, a service’s standard output goes to the journal instead of a file, and there may be no file at all:
journalctl -u nginx --since "10 min ago" journalctl -u nginx -f # follow journalctl --user -u <unit> # your own user units, not the system's
The journal is binary and rotates on its own terms. If you need a file to send someone, redirect it: journalctl -u nginx > nginx.txt.
Desktop apps: the XDG directories
| Variable | Default | Meant for |
|---|---|---|
| $XDG_CONFIG_HOME | ~/.config | Settings. Not logs, in theory |
| $XDG_STATE_HOME | ~/.local/state | Logs and history. The correct answer, and the least used |
| $XDG_DATA_HOME | ~/.local/share | Application data that should be backed up |
| $XDG_CACHE_HOME | ~/.cache | Disposable. Some applications log here, which is why logs vanish |
$XDG_STATE_HOME was added to the specification late, and adoption has been slow, so most applications still put their logs in ~/.config beside their settings. Slack uses ~/.config/Slack/logs/, and OBS Studio ~/.config/obs-studio/logs/. Games and large applications lean on ~/.local/share - Steam keeps ~/.local/share/Steam/logs/. And Spotify writes under ~/.cache/spotify/, which means anything that cleans caches deletes the evidence.
Check all four before concluding an application does not log. The variables are only defaults: if $XDG_STATE_HOME is set in your environment, the real path is wherever it points.
Snap, Flatpak and AppImage
Confined packaging redirects the home directory the application sees, so the XDG paths above still apply - just not where you expect them:
| Format | Where the same file ends up |
|---|---|
| snap | ~/snap/<name>/current/.config/... |
| flatpak | ~/.var/app/<app-id>/config/... |
| appimage | Unconfined: the normal XDG paths, as if installed from a tarball |
So the same application, same version, logs to ~/.config/obs-studio/logs/ from a distribution package and ~/.var/app/com.obsproject.Studio/config/obs-studio/logs/ from Flatpak. The catalogue records both, tagged by installer type - why log paths differ between installer types explains the rest.
Finding it anyway
find ~/.config ~/.local/state ~/.local/share ~/.cache ~/.var/app ~/snap \ -type f -name '*.log' -mmin -5 2>/dev/null
For a service, find out what it has open rather than guessing:
sudo lsof -p "$(pgrep -n nginx)" | grep -i log
That answers the question for any process, including ones with no documentation at all.
Search the catalogue for the application by name and it will give you the exact path for the package format you actually installed.