Logs: /var/log, journalctl and logrotate

Most traditional logs are plain files in /var/log:

File	Content
/var/log/syslog	General system messages (Ubuntu; messages on CentOS)
/var/log/auth.log	Logins and sudo (secure on CentOS)
/var/log/dmesg, dmesg	Kernel messages
/var/log/nginx/	Per-application logs

sudo tail -f /var/log/syslog          # follow live
journalctl -p err -b                  # errors since boot
journalctl -u ssh --since yesterday   # one service

logrotate prevents a busy log from filling the disk. A rule for your own application, saved as /etc/logrotate.d/myapp:

/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
}

Test with sudo logrotate -d /etc/logrotate.d/myapp. A full /var/log is one of the most common causes of mysterious outages, so monitor it.