Services' stdout and stderr, and programs that log through systemd 142,543 , go to the journal in /var/log/journal, which rsyslog copies into text files. Apache 129 and MySQL 524 write their own files, so the journal holds little more than their starts and stops. On Ubuntu 26.04 225 :
/var/log/syslog (everything) and /var/log/auth.log (logins, sudo, SSH).
/var/log/apache2/access.log and error.log, including mod_php errors (Apache).
/var/log/mysql/error.log: startup, shutdown, crashes, warnings (MySQL).
/var/log/php8.5-fpm.log: the PHP-FPM master process (PHP).
Most are mode 640, group adm: use sudo or join adm.