In these log files, you'll likely find a large number of entries for the root user; that's because auth.log and secure also track system logins, such as those for daemons and cron jobs, as well as ...