Understanding the Linux system log files
You’ll find the Linux log files in the /var/log/ directory. The structure of Linux log files is pretty much the same across all Linux distros. But, in the Linux tradition of trying to keep us all confused, the main log files have different names on different distros. On Red Hat-type systems, the main log file is the messages file, and the log for authentication-related events is the secure file. On Debian/Ubuntu-type systems, the main log file is the syslog file, and the authentication log is the auth.log file. Other log files you’ll see include the following:
/var/log/kern.log: On Debian/Ubuntu-type systems, this log contains messages about what’s going on with the Linux kernel. As we saw in Chapter 4, Securing Your Server with a Firewall – Part 1, and Chapter 5, Securing Your Server with a Firewall – Part 2, this includes messages about what’s going on with the Linux firewall. So, if you...
