You have successfully logged on a Linux system. You want to now cover your track. Your login attempt may be logged on several files located in /var/log. Which file does NOT belong to the list:

wtmp is a standard binary log that records all successful logins and logouts, readable via the 'last' command.

There is no standard 'user.log' file in /var/log dedicated to tracking login attempts on Linux systems. wtmp records successful logins and logouts, btmp records failed login attempts, and auth.log records authentication events including SSH and sudo - all of which an attacker would target when covering tracks.

btmp records failed login attempts and is read with 'lastb', making it a primary target for attackers covering tracks.

auth.log captures PAM, SSH, and sudo authentication events and is a well-known login-related log file on Debian-based systems.