Linux+ System Monitoring and Logging Flashcards

A Linux+ candidate needs to find which process has a specific port open. Which command achieves this most directly?

Answer: lsof -i :PORT

lsof -i :PORT lists the process name and PID that has the specified port open.

In /etc/logrotate.conf, which directive tells logrotate to keep 7 old log file versions?

Answer: rotate 7

The 'rotate N' directive in logrotate configuration specifies how many old log files to retain before deletion.

Which command displays per-CPU usage statistics interactively, similar to top but focused on each core?

Answer: mpstat -P ALL 1

mpstat -P ALL 1 reports CPU statistics for each individual processor every 1 second.

A system is experiencing high memory pressure. Which /proc file shows detailed memory usage including cache and buffers?

Answer: /proc/meminfo

/proc/meminfo provides detailed memory statistics including total, free, available, buffers, cached, and swap usage.

Which journalctl option makes the output persistent across reboots by reading from all available journal files?

Answer: --directory=/var/log/journal

Specifying --directory=/var/log/journal reads from persistent journal storage, showing logs across all previous boots.

What is the function of the 'facility' field in a syslog message?

Answer: Identifies the subsystem or source that generated the message

The facility field in syslog categorizes the source of a message (e.g., kern, auth, daemon, user) for routing and filtering purposes.

Which command shows swap space usage per process, helping identify which process is consuming swap?

Answer: smem

smem reports memory usage per process including swap consumption, unlike free or vmstat which only show system-wide totals.