Ravi Sir's Cyber Security Cards › Revision Cards
Where Logs Live
Where Logs Live Where to find the main logs on a server. Logins: /var/log/auth.log (Ubuntu) or journalctl (Amazon Linux). Web: access and error logs. Panicking at “Failed password”. Every internet server gets thousands daily. The real worry is an “Accepted” from the same IP after many “Failed”: the
Read card text
What this card says
What it is
Where to find the main logs on a server.
Logins: /var/log/auth.log (Ubuntu) or journalctl (Amazon Linux). Web: access and error logs.
Common mistake
Panicking at “Failed password”. Every internet server gets thousands daily.
The real worry is an “Accepted” from the same IP after many “Failed”: the password was guessed.
Why it matters for security
Logs are the raw evidence. Always look for a success after failures.
| Source | Location / how to read | What it shows |
|---|---|---|
| Linux authentication (Amazon Linux/RHEL) | /var/log/secure | SSH logins, sudo use, failed passwords |
| Linux authentication (Ubuntu/Kali) | /var/log/auth.log | Same as above |
| Linux system | /var/log/messages, journalctl | Services, kernel, errors |
| Apache | /var/log/httpd/access_log, error_log | Every web request, status codes, errors |
| Nginx | /var/log/nginx/access.log, error.log | Same for Nginx |
Learn more in the lesson: 31.2 Where Logs Live