Syslog has an interesting design

It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, indicating the type of system generating the message, and is assigned a severity level.

https://en.wikipedia.org/wiki/Syslog

Last log

dmesg

All logs

journalctl --dmesg

/var/log/kern.log

Get file

tail /var/log/syslog

Or invoke

journalctl --system --follow

journalctl --user --follow

Configuration is stored in /etc/rsyslog.conf

strace <COMMAND>

strace echo Hello, world!

List:

• system calls only --summary-only
• filter a system call -e <CALL>

Check network call

strace -e trace=network curl httpbin.org/get