Quiz Entry - updated: 2026.07.14
What are the most important log files in /var/log?
messages (general), secure (auth/sudo), maillog, cron, boot.log — plus the binary journal under /var/log/journal/.
/var/log is the traditional home for plain-text system logs. Knowing which file holds what saves you grepping blindly when something breaks:
| File | Contents |
|---|---|
/var/log/messages |
General system messages (on Debian/Ubuntu this file is named syslog) |
/var/log/secure |
Authentication: logins, sudo, SSH (Debian/Ubuntu: auth.log) |
/var/log/boot.log |
Output from the boot process |
/var/log/maillog |
Mail server (MTA) activity |
/var/log/cron |
Scheduled-job execution |
/var/log/journal/ |
systemd-journald's binary database (not a text file) |
The split exists because different daemons are configured (via rsyslog rules) to route their messages to different files by facility — auth goes to secure, mail to maillog, and so on. That routing is what makes "check the right file first" possible.
Reading them:
less /var/log/messages # page through general logs
tail -f /var/log/secure # watch auth events live (e.g. during a login test)
Tip: Failed logins or sudo problems? Go straight to /var/log/secure (or journalctl _COMM=sshd).