Log Files

Depending on what's installed on the server, and how your system is configured, some logs may not be on the server that is experiencing the error.

Installation Logs

These are named with a pid file extension (3-5 digit number) - generally, the most recent one is the one you're looking for

/tmp/zmsetup.log

/tmp/install.log

Runtime Logs

Most logs are found in /opt/zimbra/log/:

zimbra.log - tomcat mail services
audit.log - authentication
clamd.log - antivirus db
convertd.log - attachment conversion 
freshclam.log - clam antivirus updates
logger_myslow.log - slow logger db queries
myslow.log - slow db queries
spamtrain.log - spam/ham training
sync.log - zimbra mobile
zimbrastats.csv - server monitoring
zmconvertd.log - conversion server monitor

Some additional logs are in /opt/zimbra/tomcat/logs/:

access_log.<date> - traditional http access log for each http "hit"
catalina.out - 
stacktrace.<pid> - full thread dump from "kill -3 <tomcat pid>"; generated each time tomcat is stopped

Other log locations:

/var/log/zimbra.log - MTA log; postfix, amavisd

MTA logs

The MTA (postfix) logs via syslog to the mail facility. By default, this goes to /var/log/maillog, but Zimbra sets it to /var/log/zimbra.log

Tomcat (web server) logs

Tomcat logs via syslog to the local0 facility. By default, this goes to /var/log/zimbra.log AND /opt/zimbra/log/zimbra.log

Some tomcat information (including Stack Traces] will also be in /opt/zimbra/tomcat/logs/catalina.out; restarting tomcat generates a new /opt/zimbra/tomcat/logs/stacktrace.<pid>

Swatch

Swatch logs to /tmp/swatch.out