DEV Community

ddupard
ddupard

Posted on

Ghidra internals: Where are my logs ?

#ghidra

Ghidra uses the Apache Log4j logging library to store a lot of execution messages.

Finding these logs can be quite tricky, especially if you launch Ghidra from a shell (using ghidraRun) because no output is displayed in the terminal. Usually, the first instinct is to look for a .ghidra directory directly in your HOME folder. In our case, that will fail.

Under Linux, Ghidra follows the XDG Base Directory specification, which is why user configuration and logs are located inside ~/.config/ghidra/ instead of a direct ~/.ghidra/ folder.

1. The Quick Command

The fastest way to locate your log file is by running:

find ~ -name "application.log" 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

2. Locating Logs from IDE / Console

Another way to find your logs is when you run Ghidra through Eclipse to inspect its internals.

In Eclipse, launching Ghidra outputs startup traces directly in the console panel:

Look specifically for the following lines:

2026-08-09 23:27:53 INFO  (GhidraRun) User daniel started Ghidra.  
2026-08-09 23:27:53 INFO  (GhidraRun) User settings directory: /home/daniel/.config/ghidra/ghidra_12.2_DEV_location_ghidra-master  
2026-08-09 23:27:53 INFO  (GhidraRun) User temp directory: /tmp/daniel-ghidra  
2026-08-09 23:27:53 INFO  (GhidraRun) User cache directory: /var/tmp/daniel-ghidra  
2026-08-09 23:27:57 INFO  (GhidraRun) Ghidra startup complete (17028 ms)
Enter fullscreen mode Exit fullscreen mode

Listing the files inside the User settings directory gives:

drwx--x--x 8 daniel daniel   4096 Aug  9 23:13 .
drwxr-x--- 5 daniel daniel   4096 Jul 28 16:49 ..
drwxrwxr-x 2 daniel daniel   4096 Jul 28 16:52 analyzer_options
-rw-rw-r-- 1 daniel daniel 393379 Aug  9 23:14 application.log
drwxrwxr-x 2 daniel daniel   4096 Jul 28 16:50 bsim
-rw-rw-r-- 1 daniel daniel   9066 Aug  9 16:38 FrontEndTool.xml
drwxrwxr-x 4 daniel daniel   4096 Aug  9 16:40 osgi
drwxrwxr-x 2 daniel daniel   4096 Jul 28 16:50 parserprofiles
-rw-rw-r-- 1 daniel daniel   1428 Aug  9 23:14 preferences
-rw-rw-r-- 1 daniel daniel      0 Jul 28 16:49 script.log
drwxrwxr-x 3 daniel daniel   4096 Jul 28 17:23 symbols
drwxrwxr-x 2 daniel daniel   4096 Jul 28 16:49 tools
Enter fullscreen mode Exit fullscreen mode

And voilà! We found the application.log file containing all the execution logs.

If you inspect the parent directory of the User settings folder, you will notice several directories—each corresponding to a specific version or launch mode of Ghidra:

drwxr-x---  5 daniel daniel 4096 Jul 28 16:49 .
drwx------ 41 daniel daniel 4096 Aug  2 21:33 ..
drwx--x---  8 daniel daniel 4096 Jul 26 00:44 ghidra_12.1.2_PUBLIC
drwx--x---  8 daniel daniel 4096 Jul 26 20:24 ghidra_12.2_DEV
drwx--x--x  8 daniel daniel 4096 Aug  9 23:13 ghidra_12.2_DEV_location_ghidra-master
-rw-r-----  1 daniel daniel   42 Aug  9 23:44 lastrun
Enter fullscreen mode Exit fullscreen mode

Pro Tip: Stop Using System.out.println

Knowing where logs are saved changes how you format your debug output. Instead of relying on System.out.println, you can use Ghidra's built-in ghidra.util.Msg class to write clean, formatted lines straight to application.log:


import ghidra.util.Msg;

    private void showAnalyzer(Analyzer analyzer) {
        int nameColumnWidth = 50;
        int classColumnWidth = 80;
        int triggerColumnWidth = 30;

        AnalyzerType at = analyzer.getAnalysisType();
        Class<?> clazz = analyzer.getClass();

        String format = "%-" + nameColumnWidth + "s %-" + classColumnWidth + "s %-" + triggerColumnWidth + "s";
        Msg.info(this, String.format(format, analyzer.getName(), clazz.getName(), at.getName()));
    }
Enter fullscreen mode Exit fullscreen mode

3. Conclusion

It took me some time to figure out where Ghidra was hiding its log files. That's why I wrote this short article—hopefully, it saves you a few minutes!

Top comments (0)