Proxmox Log Files: Where to Find Them and How to Read Them

Logs Are Your First Debugging Tool

When something goes wrong on a Proxmox node, whether a VM fails to start, a backup job errors out, or the web interface stops responding, log files are always the first place to look. Proxmox VE generates logs from multiple subsystems, and knowing where each log lives and what it contains will dramatically speed up your troubleshooting workflow.

System Logs

The main system log captures kernel messages, service status changes, authentication events, and general system activity:

# View the main system log
tail -100 /var/log/syslog

# Follow the log in real time
tail -f /var/log/syslog

# Search for specific terms
grep -i "error" /var/log/syslog | tail -20

# Authentication log (SSH logins, sudo, PAM)
tail -50 /var/log/auth.log

# Kernel ring buffer (hardware, driver messages)
dmesg | tail -50
dmesg -T | grep -i "error\|warn\|fail"

The syslog is a catch-all. If you are not sure where to start, begin here and then drill down into the specific service logs below.

Proxmox-Specific Log Files

Proxmox stores its own logs in /var/log/pve/ and scattered through /var/log/. Here are the key ones:

# PVE proxy log (web interface and API)
tail -50 /var/log/pveproxy/access.log

# PVE daemon log (core Proxmox services)
journalctl -u pvedaemon --since "1 hour ago"

# PVE firewall log
tail -50 /var/log/pve-firewall.log

# PVE cluster file system log
journalctl -u pve-cluster --since "1 hour ago"

# Corosync cluster communication
journalctl -u corosync --since "1 hour ago"

# SPICE console proxy
journalctl -u spiceproxy --since "1 hour ago"

pveproxy.log and API Access

The pveproxy service handles the web interface and API requests. When the GUI is slow or returning errors, this is the log to check:

# Check for API errors
journalctl -u pveproxy --since "30 min ago" --no-pager

# Look for authentication failures
journalctl -u pveproxy | grep -i "authentication failure"

# Check if pveproxy is consuming excessive resources
systemctl status pveproxy

Task Logs

Every operation you perform through the Proxmox interface (starting a VM, running a backup, migrating a container) creates a task with its own log. Task logs are stored in /var/log/pve/tasks/ and organized by date:

# List recent tasks
pvesh get /nodes/$(hostname)/tasks --limit 10 --output-format json-pretty

# Read a specific task log by its UPID
# (You can find the UPID from the task list or the GUI)
pvesh get /nodes/$(hostname)/tasks/UPID:pve1:00001234:0ABCDEF0:65A12345:vzdump:100:root@pam:/status

# View the last backup task log
ls -lt /var/log/pve/tasks/ | head -5

# Quick way to find failed tasks
pvesh get /nodes/$(hostname)/tasks --errors 1 --limit 20 --output-format json-pretty | \
    jq -r '.[] | [.starttime, .type, .id, .status] | @tsv'

Task logs are especially important for debugging backup failures. A backup job that reports "ERROR" in the GUI will have the full error output in its task log, including which file or disk operation failed.

Firewall Logs

If you use the Proxmox built-in firewall, dropped and rejected packets are logged to a dedicated log file. This is essential for diagnosing connectivity issues:

# View firewall drops and rejects
tail -50 /var/log/pve-firewall.log

# Filter for a specific VM's firewall activity (by VM interface)
grep "tap100i0" /var/log/pve-firewall.log | tail -20

# Count drops by source IP
grep "DROP" /var/log/pve-firewall.log | \
    grep -oP 'SRC=\K[\d.]+' | sort | uniq -c | sort -rn | head -10

# Enable verbose firewall logging (temporarily, for debugging)
# In the GUI: Datacenter > Firewall > Options > Log Level: debug

Using journalctl Effectively

Since Proxmox runs on systemd, journalctl is often more powerful than reading flat log files. It supports time-based filtering, priority levels, and service-specific queries:

# Show all errors from the last hour
journalctl --since "1 hour ago" -p err

# Follow logs for a specific service in real time
journalctl -u pvedaemon -f

# Show logs for a specific VM's QEMU process
journalctl | grep "100/qemu"

# Show logs between specific timestamps
journalctl --since "2026-03-07 02:00:00" --until "2026-03-07 04:00:00"

# Show logs from the previous boot (useful after a crash)
journalctl -b -1 -p warning

# Disk usage by journal logs
journalctl --disk-usage

# Clean up old journal entries (keep only 7 days)
journalctl --vacuum-time=7d

Log Rotation

Proxmox uses logrotate to prevent logs from consuming all available disk space. The default configuration handles most cases, but you may want to adjust retention for busy systems:

# View current logrotate configuration for Proxmox
cat /etc/logrotate.d/pve

# Check logrotate status
cat /var/lib/logrotate/status | grep pve

# Manually trigger rotation (dry run first)
logrotate -d /etc/logrotate.d/pve
logrotate -f /etc/logrotate.d/pve

# Custom rotation for syslog if it grows too fast
# Edit /etc/logrotate.d/rsyslog and adjust 'rotate' count and 'size'

Monitoring logs proactively rather than only when something breaks is the mark of a well-managed environment. Review task logs after backup windows and check syslog for warnings periodically. For quick status checks without SSH, ProxmoxR surfaces task results and node health on your mobile device, so you can spot issues before they escalate.