Member-only story
8 Log Files Every Linux Admin Should Monitor Daily
--
Share
Intro:
You can’t protect what you don’t monitor. Linux logs hold the answers to failed logins, strange commands, broken services, and suspicious activity — but only if you know where to look. These 8 log files are the first places I check during audits and daily health checks on both Ubuntu and Red Hat servers.
1. /var/log/auth.log (Ubuntu) / /var/log/secure (Red Hat)
Tracks login attempts, sudo usage, and brute-force attacks.
🔍 Look for:
- Failed password
- Invalid user
- sudo: entries for privilege escalation
2. /var/log/syslog (Ubuntu) / /var/log/messages (Red Hat)
The system-wide event log.
🧠 Why it matters: If something weird is happening — kernel panic, service failure, hardware issues — it often shows up here first.
3. /var/log/cron
Shows scheduled jobs run via cron.
🔍 Watch for:
- Unexpected or unknown jobs
- Errors in job output
- Signs of malware persistence using…