The only real unique entity for logging on Cumulus Linux compared to any other Linux distribution is switchd.log, which logs the HAL (hardware abstraction layer) from hardware like the Broadcom or Mellanox ASIC.

This guide on NixCraft is amazing for understanding how /var/log works. The green highlighted rows below are the most important logs and usually looked at first when debugging.

LogDescriptionWhy is this important?
/var/log/alternatives.logInformation from the update-alternatives are logged into this log file. 
/var/log/aptInformation the apt utility can send logs here; for example, from apt-get install and apt-get remove. 
/var/log/audit/*Contains log information stored by the Linux audit daemon, auditd. 
/var/log/auth.log

Authentication logs.

Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.

 
/var/log/autoprovisionLogs output generated by running the zero touch provisioning script. 
/var/log/boot.logContains information that is logged when the system boots. 
/var/log/btmp

This file contains information about failed login attempts. Use the last command to view the btmp file. For example:

cumulus@switch:~$ last -f /var/log/btmp | more
 
/var/log/clagd.logLogs status of the clagd service. 
/var/log/dmesg

Contains kernel ring buffer information. When the system boots up, it prints number of messages on the screen that display information about the hardware devices that the kernel detects during boot process. These messages are available in the kernel ring buffer and whenever a new message arrives, the old message gets overwritten. You can also view the content of this file using the dmesg command.

Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.

 
/var/log/dpkg.logContains information that is logged when a package is installed or removed using the dpkg command. 
/var/log/faillog

Contains failed user login attempts. Use the faillog command to display the contents of this file.

Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.

 
/var/log/fsck/*

The fsck utility is used to check and optionally repair one or more Linux filesystems.

Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.

 
/var/log/installer/*Directory containing files related to the installation of Cumulus Linux. 
/var/log/lastlogFormats and prints the contents of the last login log file. 
/var/log/netd.logLog file for NCLU. 
/var/log/news/*

The news command keeps you informed of news concerning the system.

Note that Cumulus Linux does not write to this log file; but because it's a standard file, Cumulus Linux creates it as a zero length file.

 
/var/log/ntpstatsLogs for network configuration protocol. 
/var/log/openvswitch/*ovsdb-server logs. 
/var/log/frr/*Logs for FRRouting.This is how Cumulus Networks troubleshoots routing. For example an md5 or mtu mismatch with OSPF.
/var/log/rdnbrd.logLogs for redistribute neighbor. 
/var/log/snapper.logLog file for snapshots.These logs are valuable for the snapshots you take on your switch.
/var/log/switchd.logThe HAL log for Cumulus Linux.This is specific to Cumulus Linux. Any switchd crashes are logged here.
/var/log/syslogThe main system log, which logs everything except auth-related messages.The primary log; it's easiest to grep this file to see what occurred during a problem.
/var/log/wtmp Login records file.