On an LogLogic LMI appliance most of the relevant logging goes to the /var/log/sys.log file but there are some exceptions.

Bash command history is also sent to /var/log/sys.log.
The Tomcat component, which runs the web interface, uses /loglogic/tomcat/logs/catalina.out for internal logging and for LMI-specific webapp logging the /loglogic/tomcat/logs/logapp.log file is used.
All indexing-related log files are located in /loglogic/logs/.
Starting in 6.1.0 all advanced feature logs are sent to /var/log/sys.log.
Starting in 6.2.0 the default MySQL client included in LMI has command history sent to /var/log/sys.log for compliance purposes.

All events sent to sys.log are searchable in the GUI using the logapp device type for non-advanced feature logs or using the logu device type for advanced feature events.