System Logging and accounting

System log messages are stored in the /var/log/ directory tree in plain text format, most are logged through the systemd and klogd programs, which may be configured via the /etc/syslog.conf file.

The logrotate utility, launched from /etc/cron.daily/logrotate, starts a fresh log file every week or when they reach a maximum size and automatically removes or archives old log files. You may change the configuration files
/etc/logrotate.conf and /etc/logrotate.d/* as required.

In adition to syslog messages, various other log files and status files are generated in /var/log by other programs:

File Source
-------------|------------------------
audit Direcotry for audit logs
boot.msg Message from system startup
lastlog Last successful log in
vsftpd.log Transcastions log of the VSFTP daemon
localmessage Written by syslog
mail written by syslog, contains message from the MTA
messages written by syslog, contains message from su and ssh
news syslog news entries
warn written by syslog
wtmp written by the PAM susbsystem