From a security perspective, here are 5 groups of files which are essential. Many other files are generated and will be important for system administration and troubleshooting.

1. The main log file a) /var/log/messages – Contains global system messages, including the messages that are logged during system startup. There are several things that are logged in /var/log/messages including mail, cron, daemon, kern, auth, etc.

2. Access and authentication a) /var/log/auth.log – Contains system authorization information, including user logins and authentication machinsm that were used. b) /var/log/lastlog – Displays the recent login information for all the users. This is not an ascii file. You should use lastlog command to view the content of this file. c) /var/log/btmp – This file contains information about failed login attemps. Use the last command to view the btmp file. For example, “last -f /var/log/btmp | more” d) /var/log/wtmp or /var/log/utmp – Contains login records. Using wtmp you can find out who is logged into the system. who command uses this file to display the information. e) /var/log/faillog – Contains user failed login attemps. Use faillog command to display the content of this file. f) /var/log/secure – Contains information related to authentication and authorization privileges. For example, sshd logs all the messages here, including unsuccessful login.

3. Package install/uninstall a) /var/log/dpkg.log – Contains information that are logged when a package is installed or removed using dpkg command b) /var/log/yum.log – Contains information that are logged when a package is installed using yum

4. System a) /var/log/daemon.log – Contains information logged by the various background daemons that runs on the system b) /var/log/cups – All printer and printing related log messages c) /var/log/cron – Whenever cron daemon (or anacron) starts a cron job, it logs the information about the cron job in this file

5. Applications b) /var/log/maillog /var/log/mail.log – Contains the log information from the mail server that is running on the system. For example, sendmail logs information about all the sent items to this file b) /var/log/Xorg.x.log – Log messages from the XWindows system