Most important log of linux and cisco

[capricorn80]

 Hi!

  what are the most important log from security point of view in linux and cisco ?

Regards,

[Admin]

For linux, out of the box the most important files are going to be /var/log/auth.log and /var/log/messages. 

For cisco, it really depends on how the device is configured.

[capricorn80]

 Can you give me some idea about CISCO . I got 4500 and 6500 series switches.

Thanks

[Admin]

Are you running catos or ios on those switches?  What is the current logging config?

[capricorn80]

its IOS
i have setup local6 and logging syslog-ng server ip addess.

[Admin]

All of the syslog messages from the IOS switch are going to come through on local6.  It will be up to syslog-ng to separate the messages based on the priority.  The priorities that would be important to look at are:
warn, error, critical, alert and emergency. 

You can accomplish this with a filter like this:

Code:

filter f_importantIOSstuff {level(warn...emerg); };