Ghidra internals: Where are my logs ?

Ghidra uses the Apache Log4j logging library to store a lot of execution messages. Finding these logs can be quite tricky, especially if you launch Ghidra from a shell (using ghidraRun ) because no output is displayed in the terminal. Usually, the first instinct is to look for a .ghidra directory directly in your HOME folder. In our case, that will fail. Under Linux, Ghidra follows the XDG Base Directory specification, which is why user configuration and logs are located inside ~/.config/ghidra/ instead of a direct ~/.ghidra/ folder. 1. The Quick Command The fastest way to locate your log file is by running: find ~ -name "application.log" 2>/dev/null 2. Locating Logs from IDE / Console Another way to find your logs is when you run Ghidra through Eclipse to inspect its internals. In Eclipse, launching Ghidra outputs startup traces directly in the console panel: Look specifically for the following lines: 2026-08-09 23:27:53 INFO (GhidraRun) User daniel started Ghidra. 2026-08-09 23:27:53 INFO (GhidraRun) User settings directory: /home/daniel/.config/ghidra/ghidra_12.2_DEV_location_ghidra-master 2026-08-09 23:27:53 INFO (GhidraRun) User temp directory: /tmp/daniel-ghidra 2026-08-09 23:27:53 INFO (GhidraRun) User cache directory: /var/tmp/daniel-ghidra 2026-08-09 23:27:57 INFO (GhidraRun) Ghidra startup complete (17028 ms) Listing the files inside the User settings directory gives: drwx--x--x 8 daniel daniel 4096 Aug 9 23:13 . drwxr-x--- 5 daniel daniel 4096 Jul 28 16:49 .. drwxrwxr-x 2 daniel daniel 4096 Jul 28 16:52 analyzer_options -rw-rw-r-- 1 daniel daniel 393379 Aug 9 23:14 application.log drwxrwxr-x 2 daniel daniel 4096 Jul 28 16:50 bsim -rw-rw-r-- 1 daniel daniel 9066 Aug 9 16:38 FrontEndTool.xml drwxrwxr-x 4 daniel daniel 4096 Aug 9 16:40 osgi drwxrwxr-x 2 daniel daniel 4096 Jul 28 16:50 parserprofiles -rw-rw-r-- 1 daniel daniel 1428 Aug 9 23:14 preferences -rw-rw-r-- 1 daniel daniel 0 Jul 28 16:49 script.log drwxrwxr-x 3 daniel daniel 4096 Jul 28 17:23 symbols drwxrwxr-x 2 daniel daniel 4096 Jul 28 16:49 tools And voilà! We found the application.log file containing all the execution logs. If you inspect the parent directory of the User settings folder, you will notice several directories-each corresponding to a specific version or launch mode of Ghidra: drwxr-x--- 5 daniel daniel 4096 Jul 28 16:49 . drwx------ 41 daniel daniel 4096 Aug 2 21:33 .. drwx--x--- 8 daniel daniel 4096 Jul 26 00:44 ghidra_12.1.2_PUBLIC drwx--x--- 8 daniel daniel 4096 Jul 26 20:24 ghidra_12.2_DEV drwx--x--x 8 daniel daniel 4096 Aug 9 23:13 ghidra_12.2_DEV_location_ghidra-master -rw-r----- 1 daniel daniel 42 Aug 9 23:44 lastrun Pro Tip: Stop Using System.out.println Knowing where logs are saved changes how you format your debug output. Instead of relying on System.out.println, you can use Ghidra's built-in ghidra.util.Msg class to write clean, formatted lines straight to application.log: import ghidra.util.Msg; private void showAnalyzer(Analyzer analyzer) { int nameColumnWidth = 50; int classColumnWidth = 80; int triggerColumnWidth = 30; AnalyzerType at = analyzer.getAnalysisType(); Class clazz = analyzer.getClass(); String format = "%-" + nameColumnWidth + "s %-" + classColumnWidth + "s %-" + triggerColumnWidth + "s"; Msg.info(this, String.format(format, analyzer.getName(), clazz.getName(), at.getName())); } 3. Conclusion It took me some time to figure out where Ghidra was hiding its log files. That's why I wrote this short article-hopefully, it saves you a few minutes! Top comments (0)