LFCS Certification LFCS Log Management and Monitoring 1 — Questions and Answers
Question 1: Which journalctl option shows all log entries from the current boot?
- journalctl -a
- journalctl -b (Correct answer)
- journalctl --boot=all
- journalctl --current
Correct answer: journalctl -b
journalctl -b filters the journal to only entries from the current (or a numbered past) boot session.
Question 2: How do you stream new journal entries in real time, similar to `tail -f`?
- journalctl -f (Correct answer)
- journalctl --watch
- journalctl -t
- journalctl -r
Correct answer: journalctl -f
journalctl -f follows the journal and prints new entries as they arrive, just like tail -f does for plain log files.
Question 3: Which journalctl option filters output to only show entries from a specific systemd unit, e.g., sshd.service?
- -u / --unit= (Correct answer)
- --service=
- --filter=
- -s
Correct answer: -u / --unit=
journalctl -u sshd.service (or --unit=sshd.service) limits output to journal entries generated by that unit.
Question 4: Where does systemd-journald store persistent journal data by default?
- /var/log/syslog/
- /tmp/journal/
- /var/log/journal/ (Correct answer)
- /run/log/journal/
Correct answer: /var/log/journal/
/var/log/journal/ holds persistent journal files; if this directory does not exist, logs are stored in /run/log/journal/ and lost on reboot.
Question 5: Which journalctl option shows entries logged after a specified time, such as 'yesterday' or '2 hours ago'?
- --after
- --since (Correct answer)
- --from
- --start
Correct answer: --since
journalctl --since='2 hours ago' (or a specific timestamp) limits output to entries logged after that point in time.
Question 6: Which file contains the configuration for systemd-journald, including disk usage limits?
- /etc/journal.conf
- /etc/systemd/journald.conf (Correct answer)
- /var/log/journal/journal.conf
- /etc/rsyslog.d/journald.conf
Correct answer: /etc/systemd/journald.conf
/etc/systemd/journald.conf controls journald behavior, including SystemMaxUse, Compress, and Storage settings.
LFCS Certification LFCS Log Management and Monitoring 1
Which journalctl option shows all log entries from the current boot?