Red Hat family distributions (including CentOS and Fedora) use
/var/log/secure where Debian-family distributions use
Note that in newer Fedora (or RHEL/CentOS 7 if someone has gone out of their way to configure it this way), you may have no traditional syslog daemon running. In that case, the same data can be shown with
journalctl (which defaults to producing text output in the syslog format).
This is the contents of a file called README inside
/var/log/ on Fedora 28
You are looking for the traditional text log files in /var/log, and
they are gone?
Here’s an explanation on what’s going on:
You are running a systemd-based OS where traditional syslog has been
replaced with the Journal. The journal stores the same (and more)
information as classic syslog. To make use of the journal and access
the collected log data simply invoke “journalctl”, which will output
the logs in the identical text-based format the syslog files in
/var/log used to be. For further details, please refer to
Alternatively, consider installing one of the traditional syslog
implementations available for your distribution, which will generate
the classic log files for you. Syslog implementations such as
syslog-ng or rsyslog may be installed side-by-side with the journal
and will continue to function the way they always did.
I suggest search for Rsyslog
And fortunately, by default, Rsyslog service is automatically installed and should be running in CentOS/RHEL 7.
You can run this command about its status:
systemctl status rsyslog.service
There are useful information about files locations,its status and reference docs addresses.