MariaDB Logs: Find Configured Locations and Read the Right Log

MariaDB has no universal log directory. Inspect the running server's configuration, enable flags, and output destinations. A configured filename alone does not mean that a log is being written.
This guide covers read-only discovery for MariaDB 10.6 and 10.11. Use an authorized database connection; log files, journals, and provider consoles have separate access controls.

First, identify the server version:

Then inspect the existing configuration:

Read the returned Variable_name and Value pairs. MariaDB 10.11 introduced the log_slow_query naming family; older names remain aliases. The query requests both naming families, so the rows returned can vary by version. A missing variable is not an OFF value.
For the general and slow query logs, read the enable flag together with log_output:

log_output does not select the error, binary, or audit log destination. It also does not enable a log on its own.
General and slow log filenames are absolute paths or relative to datadir. These paths belong to the server, not your SQL client. Verify file existence and modification time through authorized host or provider tools before treating the file as current evidence.

Start with log_error when investigating a server failure. If it specifies a relative filename, resolve it against datadir.
On Unix, an unset error-log filename can mean messages go to standard error. Depending on how MariaDB starts, a service journal, container log stream, or provider log viewer may capture those messages. An empty log_error value does not prove that errors are not recorded. If MariaDB cannot start, use the existing service or provider logs because SQL inspection is unavailable.
Match the event time, severity, and message to the incident. The error log is not a complete record of application queries or user activity.

The general log records client connections and statements received by the server. Use an existing capture to investigate what an application sent. Receipt of a statement is not proof that its transaction committed successfully.
This log can grow quickly and expose SQL text. Inspect a narrowly scoped excerpt through an approved viewer instead of exporting the entire log.

The slow query log helps identify statements captured by the configured timing and filtering rules. The time threshold is one part of that configuration, not a guarantee that every slow request appears in the log.
Within an existing entry, compare Query_time, Lock_time, Rows_sent, and Rows_examined. These describe that recorded execution, not the performance of every execution of the same query. Keep the SQL and its timing fields together when investigating; SQL can span multiple lines.

log_bin indicates whether binary logging is enabled, and log_bin_basename identifies its configured filename prefix. The prefix is not an individual log file.
Binary logs support replication and point-in-time recovery, not slow-query analysis or auditing. Recovery requires a suitable backup and subsequent events; binary logs do not simply undo mistakes. Leave decoding, replay, deletion, and retention changes to the DBA's procedure.

For the MariaDB Audit Plugin, inspect its existing settings separately:

Check the logging flag, selected event types, and output type together. With FILE output, inspect server_audit_file_path; with SYSLOG, use the existing system-log destination. A file-path setting can name a directory rather than a complete filename.
No matching rows means these settings are not exposed in this connection; confirm the installed plugin and deployment with the administrator. It does not establish that no other auditing exists. Audit coverage depends on configuration, and the presence of an audit log alone does not establish compliance.

Logs can contain usernames, hostnames, SQL literals, credentials, and application data. Share only the minimum necessary excerpt through an approved private channel, with sensitive values removed. Check timestamps and time zones before correlating records across logs.
Read-only inspection still consumes resources. Avoid broad log-table scans or repeated polling during an incident. If the needed log was not collected, record that gap and ask the DBA to plan any logging change, including access, overhead, disk capacity, and retention. Do not enable logging or purge files just to complete this checklist.
For broader investigation, see the MariaDB performance tuning guide. For Releem product information, see MySQL performance monitoring; check deployment compatibility before choosing a monitoring workflow.