https://drive.google.com/file/d/1y71GFJo80r-u7FFDWAQc8ORMPwkcFsEL/view?usp=sharing

1. Understanding Linux Logging

Why Logs Matter

• Troubleshooting: Identify errors, warnings, and system events
• Security Auditing: Track unauthorized access attempts
• Performance Monitoring: Analyze resource usage patterns
• Compliance: Meet regulatory requirements (HIPAA, PCI-DSS)

Default Log Locations

ls -l /var/log

Key files:

• /var/log/messages - General system messages
• /var/log/secure - Authentication logs (SSH, sudo)
• /var/log/maillog - Mail server logs
• /var/log/cron - Cron job logs
• /var/log/dmesg - Kernel ring buffer messages

User Session Logs

who                 # Currently logged-in users
last                # Login history
last reboot         # System reboot history
lastlog             # Last login for all users

2. The rsyslog Daemon