LFCS Certification LFCS Log Management and Monitoring 2 — Questions and Answers
Question 1: What is the default rsyslog main configuration file path?
- /etc/syslog.conf
- /etc/rsyslog.conf (Correct answer)
- /etc/log/rsyslog.conf
- /etc/rsyslog/rsyslog.conf
Correct answer: /etc/rsyslog.conf
rsyslog reads /etc/rsyslog.conf at startup for its main configuration, including global settings and rules.
Question 2: In rsyslog filter syntax, which facility keyword represents kernel-generated messages?
- kern (Correct answer)
- kernel
- sys
- klog
Correct answer: kern
The 'kern' facility in syslog captures messages generated directly by the Linux kernel.
Question 3: Which rsyslog severity level is more critical than 'err' but less critical than 'alert'?
- alert
- crit (Correct answer)
- err
- warn
Correct answer: crit
Syslog severities in descending order are: emerg, alert, crit, err, warning, notice, info, debug — crit sits between alert and err.
Question 4: Which rsyslog rule forwards all facility/severity combinations to a remote UDP syslog server at 192.168.1.1?
- *.* @192.168.1.1 (Correct answer)
- *.* forward:192.168.1.1
- remote=192.168.1.1
- *.* | syslog 192.168.1.1
Correct answer: *.* @192.168.1.1
In rsyslog, a single @ before the address means UDP; @@ means TCP — *.* @192.168.1.1 forwards everything over UDP.
Question 5: Where should application-specific rsyslog configuration snippets be placed?
- /etc/rsyslog.conf.d/
- /etc/rsyslog.d/ (Correct answer)
- /var/log/rsyslog.d/
- /etc/syslog.d/
Correct answer: /etc/rsyslog.d/
/etc/rsyslog.d/*.conf files are included by the main /etc/rsyslog.conf via an $IncludeConfig directive.
Question 6: What command reloads rsyslog to apply configuration changes without a full service restart?
- rsyslogd -HUP
- systemctl reload rsyslog (Correct answer)
- rsyslog --reload
- service rsyslog refresh
Correct answer: systemctl reload rsyslog
systemctl reload rsyslog sends SIGHUP to rsyslogd, causing it to re-read its configuration without dropping buffered messages.
LFCS Certification LFCS Log Management and Monitoring 2
What is the default rsyslog main configuration file path?