Click the blue text
Follow us
Linux system log files are typically stored in the /var/log directory, with different log files recording different types of information. This article lists some common Linux log files and their functions. We apologize for any misunderstandings.
1. /var/log/syslog or /var/log/messages
The system log files capture a wide range of system messages, including messages from various daemons, system processes, and kernel messages. They serve as a comprehensive record of system activity.
These logs are crucial for general Linux log analysis as they contain information about system errors, warnings, and other important events (common examples include OOM logs). These logs help diagnose issues affecting system stability and performance.
2. /var/log/auth.log or /var/log/secure
The auth.log or secure log records authentication-related events, such as successful and failed login attempts, user permission changes, and other authentication mechanisms. It is essential for identifying unauthorized access attempts and potential security vulnerabilities. This log allows us to see who accessed the system and when.
By using grep “Failed password” /var/log/auth.log, you can view records of failed logins, and naturally, you can configure alert rules using ‘Failed password’ as a keyword.
3. /var/log/kern.log
The kern.log contains messages from the Linux kernel. It includes information about hardware events, driver messages, and other kernel-related activities. Kernel logs are vital for diagnosing hardware and driver-related issues, which are crucial for system stability and performance.
Of course, you can also view kernel logs using the dmesg command, for example, dmesg -T | grep -i error can be used to check for kernel errors. Similarly, ‘error’ can be configured as a keyword for alert rules.
4. /var/log/boot.log
The boot.log records events related to the system boot process, including the services that start and their statuses. This log is critical for troubleshooting boot issues. It helps identify failed services, delays in the boot process, and other boot-related problems.
For example, you can use less /var/log/boot.log to browse this file and look for lines marked with “FAILED” or “ERROR” to identify failed services during boot.
5. /var/log/dmesg
The dmesg log contains messages from the kernel ring buffer, including information about hardware components, drivers, and kernel initialization. This log is valuable for hardware diagnostics and monitoring system performance. It helps identify hardware failures and performance bottlenecks.
6. /var/log/cron
The cron log records the execution of scheduled tasks. It helps diagnose issues related to task scheduling and execution.
7. /var/log/maillog or /var/log/mail.log
The maillog or mail.log captures events related to mail server activity, including email delivery and errors. Monitoring mail logs is crucial for mail server management and resolving email delivery issues. They help ensure reliable communication within and outside the organization.
Use tail -f /var/log/maillog to check the mail log and look for lines containing “error” or “failed” to identify issues.
8. /var/log/ufw.log
The ufw.log records events related to the Uncomplicated Firewall (UFW), including allowed and denied connection attempts. Firewall logs are essential for monitoring network security and detecting unauthorized access attempts. They help maintain a secure network environment.
You can view UFW logs using commands like tail, for example, looking for repeated denied attempts from the same IP, which may indicate a security threat. Regular reviews help ensure that firewall rules are effective.
9. /var/log/audit/audit.log
The audit log contains detailed records from the audit daemon, capturing a wide range of system events for security auditing and compliance purposes. Audit logs are crucial for detailed security analysis and regulatory compliance. They provide a comprehensive view of system activities and changes.
Use aussearch and auReport tools to search and generate reports from the audit logs. Regular audits help ensure system security and policy compliance.
10. /var/log/daemon.log
The daemon log records messages from system daemons, which are background services running on the system. Daemon logs are vital for monitoring the health and performance of background services. They help troubleshoot service operation issues.
11. /var/log/btmp
The btmp log records failed login attempts, providing a record of unauthorized access attempts. The btmp log is crucial for security monitoring. It helps detect and respond to unauthorized access attempts, enhancing system security.
Use the lastb command to view failed login attempts.
12. /var/log/wtmp
The wtmp log records login and logout events, tracking user activity on the system. The wtmp log is important for tracking user behavior and understanding system usage patterns. It helps audit user activities and detect anomalies.
Use the last command to view login history. Analyze patterns to ensure users follow expected behavior and detect any suspicious activity.
Long press the QR code to follow us
CSDN Blog丨Stars in the Sky
https://blog.csdn.net/myself88129