Locations
/var/log
auth.log: stores login attempts, auth failures, security events, sudo usessyslog: Syslog, stores system events, kernel, various applications, unexpected crashes, startup activitiescron.log: contains information about creation of Cron jobsuser.logboot.log