The Linux /var/log directory is the standard location for many system and application log files. It stores records such as authentication events, daemon messages, kernel output and audit trails, which administrators use for troubleshooting, monitoring and security investigation.
What Linux /var/log Is Used For
The /var/log directory is where Linux systems commonly store operational records that help administrators understand what the host is doing. That usually includes authentication events, service activity, kernel messages, package and daemon output, and security-relevant trails that support troubleshooting and investigation.
Its value is not in the directory itself, but in the fact that it concentrates evidence about events that would otherwise be scattered across the operating system and applications. In practice, that makes /var/log one of the first places to check when a host behaves unexpectedly.
What Typically Lives in /var/log
There is no single universal log layout across every Linux distribution. File names and log routing vary by distro, init system, logging daemon, and local hardening choices, but the directory often contains a mix of general system logs, authentication logs, kernel logs, service-specific logs, and rotation archives.
Common examples include login and sudo activity, SSH events, daemon output, audit records, and application logs written by local software. On many systems, centralized logging or journald may also influence what is stored on disk versus what is queried through log tools.
Why /var/log Matters to Security Work
/var/log is central to detection and investigation because it preserves evidence of authentication attempts, privilege use, process execution, and service behavior. Those records help identify brute force activity, misconfigurations, failed services, suspicious administrative actions, and signs of compromise.
For defenders, the directory also matters because logs are only useful when they remain complete, readable, and trustworthy. If attackers can delete, alter, or suppress records, the organisation loses visibility into what happened before, during, and after an incident.
Log Handling, Retention, and Integrity
The practical challenge is not only collecting logs, but keeping them available long enough to support triage, forensic review, and compliance needs. Rotation, compression, retention, and forwarding policies all affect whether evidence survives routine maintenance and attacker activity.
Good log handling also means controlling access carefully. Logs can contain usernames, hostnames, command fragments, IP addresses, tokens, and other sensitive operational details, so broad read access can become a confidentiality problem as well as an investigative strength.
Risk and Threat Considerations
/var/log is a high-value target because it can reveal how a host is administered and how an intrusion unfolded. If logging is incomplete, writable by the wrong users, or not forwarded off-host, an attacker may erase evidence, hide lateral movement, or make post-incident reconstruction much harder.
Failure mechanism: Local log files can be tampered with, truncated, rotated away, or never generated in the first place if audit and logging paths are misconfigured or not protected with adequate permissions and forwarding.
Impact: The organisation may lose visibility into authentication abuse, privilege escalation, suspicious commands, and persistence activity, reducing both detection quality and forensic confidence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Linux /var/log stores event records used for security monitoring and investigation. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Logs in /var/log support review and analysis of authentication, privilege, and system activity. | |
| AU-9 — Protection of Audit Information | The directory's security value depends on preventing unauthorized alteration or deletion of logs. | |
| Recommendation — Define required event types and ensure Linux systems record the events that matter for detection and review. Review Linux log data regularly and investigate anomalies that indicate misuse or compromise. Protect audit logs from tampering, deletion, and unauthorized access. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | CIS emphasizes collecting, retaining, and reviewing logs needed for detection and response. |
| Recommendation — Centralize, retain, and review Linux logs so important activity remains available for investigation. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | Logging control directly governs how Linux events are recorded and monitored. |
| Recommendation — Establish logging requirements for Linux systems and verify that relevant events are captured consistently. | ||
Practitioner Guidance
What to watch for: Treat /var/log as part of the security control plane, not just a troubleshooting folder. Confirm that the most important logs are being produced, retained, and shipped to a protected destination before you need them during an incident.
Practitioner takeaway: If local logs are your only source of truth, then preserving their integrity matters as much as generating them.
Related resources from NHI Mgmt Group
- What breaks when a Kubernetes pod runs as root and mounts /var/log from the host filesystem?
- Why does a writable /var/log mount increase the risk of node compromise in Kubernetes?
- How should teams separate log integrity from privileged administration on Linux?
- Why does CMMC care so much about Linux audit log attribution and retention?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org