# common log locations - `/var/log/lastlog` for login info - `/var/log/boot.log` for system startup and initialization ![[images/Pasted image 20250803140930.png]] - `var/log/auth.log` (debian) and `/var/log/secure` (red hat) for authentication and security - `/var/log/syslog` (debian) and `/var/log/messages` (red hat) for system messages - `/var/log/btmp` and `/var/log/wtmp` for binary logins - `/var/log/kern.log` for kernel events and HW logs - `/var/log/audit.log` for policy violations - `/var/log/cron` for cron job logs - `/var/log/journal` for `journalctl` logs - `/var/log/dmesg` for kernel ring buffer - look at `dmesg` for kernel ring buffer ![[images/Pasted image 20250803141352.png]] - look at `sudo journalctl` for systemd logs ![[images/Pasted image 20250803141316.png]] - -f to follow in real time - -k for only kernel messages - -r for reverse chronological order - -b for current boot entries - -u service_name for service specific logs # log rotation - `/etc/logrotate.conf` includes log rotation config for system![[images/Pasted image 20250803141651.png]] - `/etc/logrotate.d` includes log rotation config files for individual services ![[images/Pasted image 20250803141638.png]] # systemd-journald - `systemd-journald` reads its config from `/etc/systemd/journald.conf` - `sudo journalctl | tail -f` follows `journald` logs in real time - view with `journalctl options matches` - options: - -a display all data fields - -f live follow - -r reserve order - -k for only kernel messages - -b for current boot entries - `-u service_name` for service specific logs - -l displays all printable data fields - matches - fields - kernel - priority=value - \_UID=user_id - \_HOSTNAME=host - \_TRANSPORT=method - OBJECT_PID=PID - ![[images/Pasted image 20250802203513.png]] - similar output to `dmesg` ![[images/Pasted image 20250802203802.png]] # syslog - port 514 - rsyslog uses `rsyslogd` to monitor events and log as directed based on the `/etc/rsyslog.conf` config file - many distros uses `/etc/rsyslog.d` to store individual config files includes in `/etc/rsyslog.conf` - logging occurs based on rules as follows `facility.priority action` - facility values & keywords![[images/Pasted image 20250802201628.png]] - priority values & keywords ![[images/Pasted image 20250802202016.png]] - views rsyslog entries within `/var/log/syslog`