Where are system and user logs usually stored in Linux?

In Linux, system and user logs are usually stored in the following locations:

• /var/log/ — the main directory for system logs. Here you can find:

  • syslog or messages — general system messages.
  • auth.log — authentication logs.
  • kern.log — kernel messages.
  • dmesg — kernel boot messages.
  • Service logs, such as apache2/, mysql/, etc.

• User home directories — user applications may store logs in hidden folders, such as ~/.config/ or ~/.cache/.

• /tmp/ — temporary files and sometimes temporary logs.

To view logs, commands like tail, less, journalctl (for systems with systemd) are often used. For example:

sudo tail -f /var/log/syslog
sudo journalctl -u sshd

Thus, system logs are concentrated in /var/log/, while user logs are stored in their home directories or in application-specific locations.