Where Does Linux Store Its System Logs? A Complete /var/log Guide
This article enumerates the most common Linux system log files under /var/log, explains the purpose of each log—including messages, dmesg, auth, boot, daemon, and service-specific logs—and lists key subdirectories for web, mail, audit, and other services.
System log files are located under /var/log/ and include:
/var/log/messages — contains overall system information, including logs from mail, cron, daemon, kern, auth, etc.
/var/log/dmesg — kernel ring buffer, shows hardware messages during boot; view with dmesg .
/var/log/auth.log — system authentication information, such as user logins and permission mechanisms.
/var/log/boot.log — logs generated during system boot.
/var/log/daemon.log — logs from various system daemon processes.
/var/log/dpkg.log — logs of package installation or removal via dpkg.
/var/log/kern.log — kernel‑generated logs, useful for custom kernel troubleshooting.
/var/log/lastlog — records the most recent login for all users; not an ASCII file, view with the lastlog command.
/var/log/maillog or /var/log/mail.log — mail server logs, e.g., sendmail.
/var/log/user.log — logs of user‑level messages.
/var/log/Xorg.0.log — X server log information.
/var/log/alternatives.log — records updates to the alternatives system.
/var/log/btmp — records failed login attempts; view with last -f /var/log/btmp .
/var/log/cups — printing‑related logs.
/var/log/anaconda.log — logs from the Linux installation process.
/var/log/yum.log — logs of packages installed via yum.
/var/log/cron — records each time the cron daemon starts a job.
/var/log/secure — authentication and authorization logs, e.g., sshd activity.
/var/log/wtmp or /var/log/utmp — login records; use w or who to view.
/var/log/faillog — records user login failures and related errors.
In addition to these files, /var/log may contain subdirectories for specific services, such as:
/var/log/httpd/ or /var/log/apache2 — access_log and error_log for web servers
/var/log/lighttpd/ — access_log and error_log for Lighttpd
/var/log/mail/ — additional mail server logs
/var/log/prelink/ — information about .so files modified by prelink
/var/log/audit/ — logs stored by the Linux audit daemon
/var/log/samba/ — logs from Samba
/var/log/sa/ — daily sar files collected by sysstat
/var/log/sssd/ — logs for the System Security Services DaemonSigned-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
Open Source Linux
Focused on sharing Linux/Unix content, covering fundamentals, system development, network programming, automation/operations, cloud computing, and related professional knowledge.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.