Logs are in /var/log/. grep 'Failed password' /var/log/auth.log finds SSH brute-force attempts. journalctl -b shows logs from the current boot. tail -f /var/log/nginx/access.log monitors web traffic live.
Linux Logs
/var/log/syslog # general system log
/var/log/auth.log # login attempts
/var/log/nginx/ # nginx access and error
# View logs
tail -f /var/log/syslog
grep "error" /var/log/nginx/error.log
zcat /var/log/syslog.1.gz | grep "FAIL"
# journalctl
journalctl -xe # recent errors
journalctl -k # kernel messages
journalctl --since today