List of Linux Log Files
The following is a list of commonly found log files within Linux, alongside a short description of what kind of information each file contains. Typically, all log files on linux servers are located under the /var/log directory. Depending on the setup of your server though, these locations may vary.
- /var/log/message – This is standard system log file in which various system applications and daemons record their messages. The messages stored here are typically informational and non-critical in nature.
- /var/log/auth.log – The auth.log file contains records on all authentication related events. It can be useful for troubleshooting potential security breaches by searching for external login attempts.
- /var/log/kern.log – The kern.log file holds all records related to kernel. If you need to troubleshoot issues related to kernel, the information you need to do so will be stored here.
- /var/log/cron.log – The cron.log file contains information related to cron jobs. Each time a cron job is executed, information related to the process is stored here for future reference.
- /var/log/mail.log – The mail.log file stores information related to your mail server. If you need information about your mail server’s settings or extensions, it can be found in this file.
- /var/log/qmail/ – If you use qmail, the Unix-based mail transfer agent, then similar to the mail.log file mentioned above, any records related qmail will be stored here in the /qmail/ log.
- /var/log/httpd/ – This log is useful, because it stores information related to Apache access and error logs. If your server is having issues with httpd requests, the system messages addressing this will be located here.
- /var/log/lighttpd – If your server has lighttpd, then similar to the /httpd/ file, you can find access and error logs related to lighttpd, in this directory.
- /var/log/boot.log – The boot.log file contains information regarding your system’s start up process. If your system is having issues booting up or shutting down, any information regarding this will be stored here.
- /var/log/mysqld.log – The mysqld.log file contains all information related to your MySQL databases. If you’re using Debian or Ubuntu, the log file will be called mysql.log instead, but will contain the same information.
- /var/log/secure – This is an authentication log similar to the auth.log file and contains much of the same information. It is primarily used on Redhat or CentOS based systems.
- /var/log/utmp or /var/log/wtmp – The /wtmp file contains login records including time of login and duration of sessions for each user in the system.
- /var/log/yum.log – The yum.log file stores information related to installations made using yum. If you need information on whether a package was installed correctly, those logs can be found here.
While this list certainly does not cover every log file found within Linux, it does provide information on the most commonly used and most crucial ones. By understanding how to locate these files and what sort of information they contain, you can build a better understanding of potential issues your server may be facing.