The Linux log file function in the/var/log directory

Excerpt from: http://www.niaoyun.com/help/application/386.html

Learning Linux should know where the log files are located and what they contain, and learning about these different log files while the system is functioning can help you to find and solve the problem in an emergency situation.

The following is a log file located under the/var/log/directory. Some of these are only available for specific versions, such as Dpkg.log only in Debian-based systems.

The/var/log/messages-includes overall system information, which also contains logs during system startup. In addition, content such as Mail,cron,daemon,kern and Auth is also recorded in the Var/log/messages log.
The/var/log/dmesg-contains kernel buffering information (kernel ring buffer). When the system starts, many hardware-related information is displayed on the screen. You can view them with DMESG.
/var/log/auth.log-contains system licensing information, including user login and use of the permissions mechanism.
/var/log/boot.log-contains the log at system startup.
The/var/log/daemon.log-contains various system daemon log information.
/var/log/dpkg.log-includes the installation or DPKG command to clear the log of the package.
/var/log/kern.log-contains the logs generated by the kernel to help resolve problems when customizing the kernel.
/var/log/lastlog-records the most recent information for all users. This is not an ASCII file, so you need to use the Lastlog command to view the content.
/var/log/maillog and/var/log/mail.log-contain the log information of the system running the e-mail server. For example, SendMail log information is all sent to this file.
/var/log/user.log-logs all levels of user information.
/var/log/xorg.x.log-the log information from X.
/var/log/alternatives.log-Update replacement information is recorded in this file.
/var/log/btmp-Logs all failed login information. Use the last command to view the Btmp file. For example, Last-f/var/log/btmp | More.
/var/log/cups-A log that involves all printing information.
/var/log/anaconda.log-when installing Linux, all installation information is stored in this file.
The/var/log/yum.log-contains package information that is installed with Yum.
/var/log/cron-each time the cron process starts a job, the information is recorded in this file.
The/var/log/secure-contains authentication and authorization aspects information. For example, SSHD will record all information (including failed logins) here.
/var/log/wtmp or/var/log/utmp-contains login information. Use Wtmp to find out who is logging into the system, who uses the command to display this file or information, and so on.
/var/log/faillog-contains user logon failure information. In addition, the error login command is also recorded in this file.

In addition to manually archiving and clearing these log files, you can use Logrotate to automatically delete files after they reach a certain size. You can try to view these log files with commands such as Vi,tail,grep and less.

The Linux log file function in the/var/log directory