System Logs
Where Logs Live
Traditional text logs are under /var/log:
| File | Contents |
|---|---|
/var/log/syslog / messages | General system messages |
/var/log/auth.log / secure | Authentication & sudo |
/var/log/kern.log | Kernel messages |
/var/log/dmesg | Boot-time kernel ring buffer |
/var/log/boot.log | Boot service output |
Modern systemd systems centralise logs in the journal (journalctl, covered in the systemd module) - many distros run both.
$ sudo tail -f /var/log/auth.log
$ journalctl -u ssh --since '10 min ago'Exam tip: Debian usessyslog/auth.log; RHEL usesmessages/secure. Know both names.