Log Files
-
/var/log/syslog or /var/log/messages: general messages, as well as system-related information. Essentially, this log stores all activity data across the global system.
-
/var/log/auth.log or /var/log/secure: store authentication logs, including both successful and failed logins and authentication methods. Again, the system type dictates where authentication logs are stored; Debian/Ubuntu information is stored in /var/log/auth.log, while Redhat/CentrOS is stored in /var/log/secure.
-
/var/log/boot.log: a repository of all information related to booting and any messages logged during startup.
-
/var/log/maillog or var/log/mail.log: stores all logs related to mail servers, useful when you need information about postfix, smtpd, or any email-related services running on your server.
-
/var/log/kern: stores Kernel logs and warning data. This log is valuable for troubleshooting custom kernels as well.
-
/var/log/dmesg: messages relating to device drivers. The command dmesg can be used to view messages in this file.
-
/var/log/faillog: contains information all failed login attempts, which is useful for gaining insights on attempted security breaches, such as those attempting to hack login credentials as well as brute-force attacks.
-
/var/log/cron: stores all Crond-related messages (cron jobs), such as when the cron daemon initiated a job, related failure messages, etc.
-
/var/log/messages : General message and system related stuff
-
/var/log/auth.log : Authenication logs
-
/var/log/kern.log : Kernel logs
-
/var/log/cron.log : Crond logs (cron job)
