Mastering Linux Security and Hardening - Second Edition

Understanding the Linux system log files

You'll find the Linux log files in the /var/log directory. The structure of Linux log files is pretty much the same across all Linux distros. But, in the Linux tradition of trying to keep us all confused, the main log files have different names on different distros. On Red Hat-type systems, the main log file is the messages file, and the log for authentication-related events is the secure file. On Debian-type systems, the main log file is the syslog file, and the authentication log is the auth.log file. Other log files you'll see include the following:

• /var/log/kern.log: On Debian-type systems, this log contains messages about what's going on with the Linux kernel. As we saw in Chapter 3, Securing ...