Primary Linux Authentication Log File: /var/log/auth.log
Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?
Quick Answer
The answer is /var/log/auth.log, which serves as the primary Linux authentication log file for recording events like user logins, sudo usage, and failed authentication attempts. This file is the central repository for all security-related authentication data because the system’s Pluggable Authentication Modules (PAM) and the login process write directly to it, making it the first place a forensic examiner looks when investigating unauthorized access or privilege escalation. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to distinguish between standard Linux log files under /var/log, with a common trap being that /var/log/syslog captures general system messages but not authentication-specific details, while /var/log/secure serves the same role on RHEL-based distributions. A reliable memory tip is to associate “auth” with “authentication” and remember that if you see a log about who logged in or used sudo, it’s always the auth.log file you need.
⚠ Common exam trap
In EC-CHFI, candidates often confuse /var/log/syslog with /var/log/auth.log, thinking syslog captures all system events. However, authentication events are specifically routed to a separate file (auth.log or secure) for security isolation and forensic analysis of user access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/var/log/auth.log
/var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/var/log/kern.log
Why it's wrong here
kern.log is for kernel messages.
- ✗
/var/log/syslog
Why it's wrong here
syslog is general system log, not auth-specific.
- ✗
/var/log/boot.log
Why it's wrong here
boot.log records boot messages.
- ✓
/var/log/auth.log
Why this is correct
auth.log records authentication events.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which Linux log file is the primary source for authentication-related events, including SSH login attempts and sudo usage?
easy- A./var/log/kern.log
- B./var/log/syslog
- ✓ C./var/log/auth.log
- D./var/log/messages
Why C: /var/log/auth.log is the dedicated Linux log file for authentication-related events, including SSH login attempts (via PAM and sshd), sudo usage, and user authentication failures. This file is managed by the syslog daemon and is the primary source for forensic analysis of authentication activity on Debian-based systems.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.