Throughout its operation, a Linux server records a very large number of settings, information, and events, which are written to files: these are your server's logs.

On the vast majority of Linux operating systems, these log files are stored in the /var/log directory

total 2564
-rw-r--r-- 1 root root   15071 Aug  8 17:24 alternatives.log
drwxr-xr-x 2 root root    4096 Aug  9 08:55 apt
-rw-r----- 1 root adm   876834 Aug  9 09:54 auth.log
-rw------- 1 root utmp 1175040 Aug  9 09:54 btmp
-rw-r----- 1 root adm    68367 Aug  9 09:13 daemon.log
-rw-r--r-- 1 root root  320780 Aug  9 08:55 dpkg.log
-rw-r----- 1 root adm    19690 Aug  9 09:54 fail2ban.log
-rw-r--r-- 1 root root    3456 Dec 12  2017 faillog
-rw-r----- 1 root adm     2907 Jan 24  2018 kern.log
-rw-r--r-- 1 root root     292 Aug  9 08:48 lastlog
-rw-r----- 1 root adm     1100 Aug  8 17:23 mail.info
-rw-r----- 1 root adm     1100 Aug  8 17:23 mail.log
-rw-r----- 1 root adm     3334 May 26 15:58 messages
-rw-r--r-- 1 root root   75153 Aug  9 09:39 syslog
-rw-rw-r-- 1 root utmp   14976 Aug  9 08:48 wtmp```

Each file corresponds to a different type of service. Some are very explicit (mail.log corresponds to the logs of emails handled by your server), while others are a bit less so. Here is a list of some of the log files you can find on a Linux server:

auth.log: Corresponds to the authentication logs on your server (most often SSH). You will find information about login attempts on your VPS, the reasons they were refused, and the history of successful connections.

kern.log: Corresponds to your kernel's logs. It contains the most recent events recorded by the kernel. This can include various information about its normal operation (network card startup, system boot), as well as errors encountered.

mail.log: As the name suggests, it corresponds to the logs of emails handled by your VPS. It is very useful to check it, especially if support reports an email spam problem to you.

apt/history.log: Contains the history of changes made via APT (software installation/removal for example)

fail2ban.log: If you have installed and configured Fail2ban ([this way](/fr/article/renforcer-la-securite-dun-serveur-md1poq/)), it contains the history of IP detections and bans on your VPS.

syslog: This is a bit of a "catch-all" file. You will find the general logs of your system there. It contains a lot of essential information, such as operations performed on the various services, runtime errors encountered, defects detected by the system, etc.

Each log file is different, so there is no universal methodology for handling them. However, several things are good to know:

*   The most recent logs are always added at the end of the file. The oldest ones are therefore at the top of the file
*   The logging system regularly does some "housekeeping" in the logs: it creates new empty files and saves the old ones in compressed format (.gz) to use less disk space. The latter are kept for several days
*   The .log files are not essential to your system (it knows how to run without them). If you run out of disk space on your server, a little cleanup in the logs can help you free up some space.

Here are also a few commands that may be useful for monitoring your log files:

##### View the contents of a log file in real time

``` root@HelpDesk:/var/log# tail -f monfichier.log```

##### Search within a log file

root@HelpDesk:/var/log# grep "mot-clef" monfichier.log


List the latest SSH connections

root@HelpDesk:/var/log# grep "Accepted" auth.log