Ghidra internals: Where are my logs ?

Ghidra, a software reverse engineering framework, utilizes the Apache Log4j logging library to record various execution messages. However, locating these logs can prove challenging, particularly when Ghidra is launched from a shell (using ghidraRun) as no output is displayed in the terminal. The initial assumption might be to search for a .ghidra directory within the user's HOME folder, but this approach will not yield results.

On Linux systems, Ghidra adheres to the XDG Base Directory specification, which means user configuration and logs are now situated inside ~/.config/ghidra/ rather than a direct ~/.ghidra/ folder.

A quick command to locate the log file is "find ~ -name application.log". When Ghidra is run through Eclipse, startup traces can be inspected in the console panel. The crucial lines to look for are: "User daniel started Ghidra", the user's settings directory, and other relevant directories like the temp and cache directories. Listing the files inside the user's settings directory reveals the "application.log" file, which contains all the execution logs.

Upon exploring the parent directory of the user settings folder, several subdirectories can be observed, each corresponding to a specific Ghidra version or launch mode. To avoid relying on System.out.println for debug output, it is recommended to use Ghidra's built-in ghidra.util.Msg class to write clean and formatted lines directly to application.log.

By importing the Msg class and using it to format log messages, developers can streamline their debugging process and avoid common pitfalls associated with traditional logging methods.