I would place them in
/var/log/package_name; it satisfies the principle of least surprise better than
/var/opt/package_name/log. I don't have a citation for this; it simply matches where I'd look for logs.
I might also forego writing my own log files, and instead log to
syslog with an appropriate tag and facility; if I'm looking for clean integration with established analysis tools, I don't believe I can do better for a communications channel:
- Every generic tool with "log analysis" as a listed feature already watches
- Log file release and rotation semantics are handled for me; I don't have to set up a mechanism for
logrotate to tell me to let go of the file and open a new one. I don't even have to tell
logrotate about new files to rotate!
- Offloading logs to central logging servers is handled for me, if the site demands it; Existing established tools like
rsyslog will be in use if needed, so I don't have to contemplate implementing that feature myself.
- Access controls (POSIX and, e.g. SELinux) around the log files are already handled, so I don't need to pay as much attention to distribution-specific security semantics.
Unless I'm doing some custom binary format for my log and even then, I prefer syslog-friendly machine-parseable text formats like JSON. I have a hard time justifying my own separate log files; analysis tools already watch
syslog like a hawk.