Linux+ System Monitoring and Logging Flashcards

Which command would permanently increase the open file descriptor limit for all users across reboots?

Answer: Edit /etc/security/limits.conf

Editing /etc/security/limits.conf sets per-user and system-wide file descriptor limits that persist across reboots via PAM.

An admin wants to capture all failed SSH login attempts from the journal. Which journalctl command filters only for sshd unit logs?

Answer: journalctl -u sshd

The -u flag filters journalctl output to messages from a specific systemd unit, such as sshd.service.

Which tool provides a unified view of CPU, memory, network, and disk statistics in a single terminal window?

Answer: glances

glances is a cross-platform monitoring tool that displays CPU, memory, disk, and network metrics in a single curses-based interface.

What does setting 'compress' in a logrotate stanza do?

Answer: Compresses rotated log files using gzip by default

The 'compress' directive in logrotate causes rotated log files to be compressed with gzip (producing .gz files) to save disk space.

A system has been running for 45 days. Which command shows the average CPU idle percentage for the past 30 days using historical sar data?

Answer: sar -u -f /var/log/sa/sa01

sar saves daily reports in /var/log/sa/ as files named saDD (day number); the -f flag reads a specific historical file.

Which /proc entry shows the CPU scheduling statistics and context switch counts for a specific process?

Answer: /proc/PID/schedstat

/proc/PID/schedstat contains the number of nanoseconds the process ran on CPU, waited for CPU, and the context switch count.

Which command checks whether auditd is actively capturing events and shows its current running status?

Answer: auditctl -s

auditctl -s displays the current status of the audit system, including whether it is enabled and the number of rules loaded.