Important Logs to monitor to identify issues in the Linux system
An important part of System Administration is make sure that all the infrastructure is always up & working fine and if problems do arise on the servers, then to resolve those problems. We use various logs generated on our systems to identify the problems occurred & then resolve the issues based on the findings from the logs.
In this tutorial, we are going to learn some of the logs that are created on the Linux machines & what they are used for.
/var/log/boot.log
It stores all the boot related messages & is helpful in identifying issues related to booting of the system. So all the issues related to boot failures, unexpected or unplanned shutdown or unplanned reboot of the system can diagnosed using the boot.log.
/var/log/secure (RHEL/CentOS) & /var/log/auth.log (Debian/ubuntu)
Both files i.e. secure for RHEL & auth.log for Debian, serves same purpose. They are used to store all the events related to authentication. So if you are trying to locate an issue that’s related to authorization of the users, these are log files to look out for. Both these files can be used to investigate failed login attempts either directly to server or via ssh, also can be used for checking brute-force attempts & can these files also logs all the successful login attempts.
/var/log/faillog
Logs all the failed attempts for login to the system. This is another important file that can help us track security breaches or brute force attacks.
/var/log /dmesg
If you suspect any issues created by hardware, then this should be the first file that you look for. This log file is useful to diagnose any issue created by a hardware part or a driver for the hardware.
/var/log/messages (RHRL/CentOS) & /var/log/syslog (Ubuntu/Debian)
Both these files for their respective operating systems, contain all the non-critical & informational messages. These files can be used to track non-kernel boot errors or application related issues. This should be the first file to check, in case you are facing any of the above mentioned errors.
/var/log/daemon.log
Contains information related to various background daemons that runs in the background of our system. Though required very less but can help in diagnosing issues created by daemons.
/var/log/kern.log
Kern.log logs all the kernel related messages & contains all the information related to kernel. Helps us troubleshoot the warnings or errors generated by kernel, can also be used to diagnose connectivity & hardware issues.
/var/log/setroubleshoot
If you have SElinux enabled (we should keep it enabled), than this log file helps us track all the issues related to security context of the files.
/var/log/yum.log
Yum.log has all the information related to software installations on your server. You can check it to make sure that the packages are properly installed or not, or if a installed package is behaving in unusual manner then use yum.log to diagnose the issue.
/var/log/mail.log /var/log/maillog
All the messages related to mail are stored in these files. It contains all the information for mails sent or received, failed & successful delivery reports, spamming attempt etc. So any issue arising out of sending or receiving of mails can be diagnosed with these files.
/var/log/cron.log
This log files lists all the messages created upon execution of scheduled cron job, whether they are successful messages or the error for the cron job.
There are also individual files related to services like httpd.log or mysqld.log, that are used to diagnose problems related to those services.
