Orsdxy

When I check the /var/log, I find something very strange

me@me:~$ ls -lt /var/log |head -6 '

total 160368

-rw-r-----  1 syslog            adm              19919118 Jan 15 16:55 auth.log

-rw-r-----  1 syslog            adm             139702302 Jan 15 16:55 syslog

-rw-r-----  1 syslog            adm                191122 Jan 15 16:55 mail.log

-rw-r-----  1 syslog            adm               2210432 Jan 15 16:32 kern.log

-rw-r--r--  1 root              root              1741863 Jan 15 14:22 dpkg.log

Notice that the owner of the first four log file is syslog. It's weird, because there is only one user on my system:

me@me~$ users

me

Why could a filename syslog be a user?

It has to do with security and permissions on accessing your system.

And no you have A LOT MORE users then just your own user. There is "root", "daemon","bin", "games", "nobody", "list".

Do a more /etc/passwd for a list of users on your system. You will see lots of lines with "/usr/sbin/nologin" That means those can not be used as a normal user with a login like your own user can. The 3rd column is the user ID. All user IDs below 1000 are pseudo users. Your 1st sudo user (the one that installed the system) has 1000 by default.

Basically user syslog is allowed to use the /var/log/ directory that is set as a directory owned by root. To not have to compromise permissions on the directory (ie. lower the permissions so other users can use it) this user was created.

The same is done with the user for apache and mysql (you will see a www-data user and group and a mysql user and group when you install these) but it is used for loads of things. There is a group "dialout" that is used to access devices to externals. Users get added to this group to allow the user to use these devices. Otherwise you will get a permission denied. Works 2 ways: denying a user access means removing the group.

Because syslog it is not a file, it is a daemon used by the system to store system daemon and application messages (debug,error,warn,info) to files.

Read here for a brief of syslog history.

In other distribution like the RedHat based, the syslog output for the system is stored in to file called messages it depends on configuration.

as per @Rinzwind says, for security reason different components in the Operating System, run with a specific user, and each user get is own rights, for example syslog at least have the write rights on /var/log folder.

There have a lot user to run a lot service, apache get www-data|httpd|apache normally this daemon user do not get bash access to avoid security leack.