On Linux systems, you should put log files under /var/log and use consistent naming.
Each of the components in ArcGIS Enterprise seems to keep its logs in a different place; Portal is the worst so far from what I have looked at; the log files are buried in a folder named after the host, and the active log file has a long name with seemingly random characters embedded in it (possibly including the process id?)
Furthermore, you allow the location to be changed in API calls.
The net result is that when I start a copy of Portal running, I have to search out the new log file.
So for example, Portal could always log to /var/log/arcgis/portal.log instead of