LOGS in Linux

Linux log files are plain-text files that can be found in the /var/log directory and subdirectories. Linux logs exist for everything: system, kernel, package managers, boot processes, Xorg, Apache, MySQL, and so on. This essay will concentrate on Linux system logs in particular.

How Logs Can Help ?

Troubleshooting
When something goes wrong on a Linux system, logs might assist in determining the problem. It is feasible to find failures, warnings, and other messages that indicate what went wrong by inspecting system logs, application logs, and service logs.

Troubleshooting Performance Issues
System logs can aid in the detection of performance issues such as memory leaks or disc I/O bottlenecks. Examining application logs can also aid in the identification of performance issues with individual applications.

Monitoring the Health of the System
Linux logs can be used to monitor system health and identify problems before they become serious. Administrators can spot trends and patterns in system logs that may suggest the onset of a problem.

Auditing and Compliance
Many businesses are required to keep logs for compliance and auditing purposes. By providing a record of system activity, Linux logs can assist organizations in meeting these standards.

Security
Linux logs are a critical tool for discovering and monitoring security risks. System logs can help identify suspicious behavior within individual apps, whereas application logs can help detect unauthorized access attempts. Administrators can swiftly discover and respond to security events by monitoring logs.

Mainly there are four types of log files generated in a Linux-based environment and they are:

• Application Logs.

• Event Logs.

• Service Logs.

• System Logs.

1. /var/log/messages :

   1. This file contains data on general system activity.

   2. This is the log file that stores non-critical and informational system communications.

   3. This file mostly stores non-kernel boot failures, application-related service errors, and system-starting notifications. If something goes wrong, this file should be checked first.

   4. It appears that you are having problems with your sound card. You can examine the messages saved in this log file to see whether anything went wrong during the system startup procedure.

2. /var/log/secure :

   1. This file contains data on all user authentication details.

   2. This log file is mostly used to determine authorization system usage.

   3. This file contains a record of all security messages, including the authentication failure.

   4. This file stores sudo logins, SSH logins, and other system security service daemon problems.

   5. This file is quite valuable in detecting hacker attempts.
      This file also maintains information about successful logins and can be used to verify the activity of legitimate users.

3. /var/log/boot.log

   1. This file contains information on all bootup messages.

   2. This file stores messages relating to difficulties such as improper shutdown, unscheduled reboots, or booting failures.

   3. This file's log entries can be used to determine the length of system downtime caused by an unexpected shutdown.

4. /var/log/kern.log

   1. This file includes the kernel's logging information.

   2. This file's entries are useful for resolving kernel-related issues and warnings.
      This file's log entries are extremely useful for detecting problems with the custom-built kernel and for diagnosing hardware and connection difficulties.

5. /var/log/faillog

   1. This file gives details on all failed login attempts.

   2. This log file's entries are used to detect attempted security breaches using username/password hacking and brute-force assaults.

6. /var/log/cron

   1. This file includes the details for all cron jobs.

   2. If any of your crons are having problems, you may find the relevant entry in this file.

   3. When a cron job executes, this log file records all important information, including successful execution and failure messages.

7. /var/log/mail.log :

   1. This file contains information on all mail server details.

   2. This file contains entries or information on the mail server's postfix, smtp, MailScanner, SpamAssassin, and other email-related services.

   3. All emails sent or received during a specific time period can be tracked.

   4. The entries in this file can be used to investigate failed mail delivery issues.

   5. This file contains information about any probable spamming efforts that were prevented by the mail server.

   6. This file's entries can be used to determine the origin of an incoming email.

8. /var/log/httpd :

   1. This directory includes information about the logs that the Apache server keeps.

   2. This directory contains two files, error_log and access_log, that save information from the Apache server.

   3. The error_log contains messages relating to httpd errors such as memory problems and other system difficulties. Check this log for diagnostic information if something goes wrong with the Apache web server.

9. /var/log/mysql.d :

   1. This file stores all mail debug, failure, and success messages associated with the [mysqld] and [mysqld_safe] daemons.

   2. This file's entries are used to diagnose problems when starting, running, or halting mysqld.

   3. This file contains information on client connections to the MySQL data directory.