Linux+ System Monitoring and Logging Flashcards
6 cards from real Linux practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Linux+ System Monitoring and Logging flashcards as text
A system administrator notices that systemd journal logs are being cleared after every reboot. Which of the following actions will ensure logs are stored persistently across reboots?
Answer: Create the directory /var/log/journal.
By default, systemd-journald uses volatile storage at `/run/log/journal` if the persistent storage directory does not exist. Creating the `/var/log/journal` directory signals to systemd-journald to automatically start writing logs there, making them persistent across reboots.
A system administrator is editing a logrotate configuration file for a busy web server. Which directive should be used to ensure that rotated log files are compressed to save disk space?
Answer: `compress`
The `compress` directive in a logrotate configuration file instructs the utility to compress the log file after it has been rotated. By default, it uses the gzip utility.
A Linux server is experiencing slow application performance, and the administrator suspects a disk I/O bottleneck. Which command provides detailed, real-time statistics for block devices, including transactions per second (tps) and kilobytes read/written per second?
Answer: `iostat`
The `iostat` command is specifically designed to monitor system input/output device loading and provides detailed reports on CPU and device utilization, including metrics like transactions per second (tps), and data transfer rates.
An administrator needs to forward all log messages with a priority of `crit` or higher to a central log server at `10.50.1.100` using the reliable TCP protocol. Which of the following lines is correctly formatted for `/etc/rsyslog.conf`?
Answer: `*.crit @@10.50.1.100:514`
In rsyslog syntax, `*.crit` selects all facilities at the `crit` priority and higher. The `@@` directive specifies forwarding via the TCP protocol, which is considered reliable, to the given IP address and port. A single `@` would indicate UDP.
While interactively monitoring a system with the `top` command, a system administrator wants to sort the list of processes by memory consumption to identify which applications are using the most RAM. Which key should be pressed?
Answer: `M`
Within the `top` interface, pressing the uppercase `M` key will immediately resort the process list to show the processes consuming the most resident memory at the top.
A server unexpectedly rebooted overnight. To investigate the cause, an administrator needs to examine the journald logs from the boot session that occurred *before* the current one. Which command will display these specific logs?
Answer: `journalctl -b -1`
The `journalctl` command uses the `-b` flag to filter logs by boot session. `-b 0` or just `-b` refers to the current boot. `-b -1` refers to the immediately preceding boot, making it the correct choice for investigating events that led to the last reboot.