Various (Linux Foundation)

Linux server logs encompass security-relevant event data from Linux-based operating systems including authentication logs (auth.log/secure), system logs (syslog/journal), audit logs (auditd), and application-specific logs. These logs capture user logins, privilege escalation, process execution, file access, and system configuration changes. 

Collecting and monitoring Linux server logs is essential for detecting unauthorized access, privilege escalation attacks, lateral movement, and persistent threats in enterprise environments. Key log sources include PAM authentication events, sudo usage, SSH sessions, SELinux/AppArmor denials, and kernel audit records that provide detailed forensic evidence for security investigations.