Locating and reading system logs: /var/log/messages, /var/log/secure, journalctl -u, -p, -b, --since

Logs are the first place to look when something fails: a service that will not start, a login that is refused, a disk that will not mount. RHEL has two cooperating logging systems. systemd-journald collects messages from the kernel, the boot process, services and programs into a structured binary journal. rsyslog, a traditional syslog daemon, receives messages from the journal and writes them to plain text files in /var/log/, sorted by type.