| Purpose | Debian / Ubuntu | RHEL family |
|---|---|---|
| General system messages | /var/log/syslog |
/var/log/messages |
| Authentication / sudo / sshd | /var/log/auth.log |
/var/log/secure |
| Kernel | /var/log/kern.log |
in /var/log/messages |
| Cron | /var/log/cron.log (disabled by default) |
/var/log/cron |
/var/log/mail.log |
/var/log/maillog |
|
| Package manager | /var/log/dpkg.log, /var/log/apt/ |
/var/log/dnf.log, /var/log/dnf.rpm.log |
| Boot messages | journalctl -b (/var/log/boot.log on some) |
/var/log/boot.log |
| Audit framework | /var/log/audit/audit.log |
/var/log/audit/audit.log |
| Login history (binary) | /var/log/wtmp, /var/log/btmp, /var/log/lastlog |
same |
| Journal (persistent) | /var/log/journal/<machine-id>/ |
/var/log/journal/<machine-id>/ |
| Journal (volatile) | /run/log/journal/<machine-id>/ |
/run/log/journal/<machine-id>/ |
| Per-application | /var/log/nginx/, /var/log/postgresql/, /var/log/named/, … |
/var/log/nginx/, … |
The authoritative mapping of "which messages go to which file" on a syslog system is in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf. If a file you expect is missing, read those first.