Server log files

Reading your server logs is a crucial element in the analysis of an incident, it allows you to identify disruptive elements and correct problems of stability or availability, if any.

On Linux systems the analysis of log files is done in the default folder var/log.

Linux has several log files relating to the different applications:

• The syslog is the log file that contains information about the system
• The message file displays all the messages sent by the system
• The auth file records any connections or connection attempts to system
• The dmesg file records all information during the startup of your system

Microsoft provides a detailed documentation about the log files of Windows

Windows Event Logs