Free Linux+ System Monitoring and Logging Questions and Answers 1 — Questions and Answers
Question 1: A system administrator notices that systemd journal logs are being cleared after every reboot. Which of the following actions will ensure logs are stored persistently across reboots?
- Create the directory /var/log/journal. (Correct answer)
- Set `Storage=volatile` in /etc/systemd/journald.conf.
- Run the `journalctl --flush` command.
- Restart the rsyslog service.
Correct answer: Create the directory /var/log/journal.
By default, systemd-journald uses volatile storage at `/run/log/journal` if the persistent storage directory does not exist. Creating the `/var/log/journal` directory signals to systemd-journald to automatically start writing logs there, making them persistent across reboots.
Question 2: A system administrator is editing a logrotate configuration file for a busy web server. Which directive should be used to ensure that rotated log files are compressed to save disk space?
- `gzip`
- `archive`
- `compress` (Correct answer)
- `reduce`
Correct answer: `compress`
The `compress` directive in a logrotate configuration file instructs the utility to compress the log file after it has been rotated. By default, it uses the gzip utility.
Question 3: A Linux server is experiencing slow application performance, and the administrator suspects a disk I/O bottleneck. Which command provides detailed, real-time statistics for block devices, including transactions per second (tps) and kilobytes read/written per second?
- `free -h`
- `ps aux`
- `iostat` (Correct answer)
- `lsof`
Correct answer: `iostat`
The `iostat` command is specifically designed to monitor system input/output device loading and provides detailed reports on CPU and device utilization, including metrics like transactions per second (tps), and data transfer rates.
Question 4: An administrator needs to forward all log messages with a priority of `crit` or higher to a central log server at `10.50.1.100` using the reliable TCP protocol. Which of the following lines is correctly formatted for `/etc/rsyslog.conf`?
- `*.crit | /dev/tcp/10.50.1.100:514`
- `*.crit @10.50.1.100:514`
- `mail.crit > 10.50.1.100`
- `*.crit @@10.50.1.100:514` (Correct answer)
Correct answer: `*.crit @@10.50.1.100:514`
In rsyslog syntax, `*.crit` selects all facilities at the `crit` priority and higher. The `@@` directive specifies forwarding via the TCP protocol, which is considered reliable, to the given IP address and port. A single `@` would indicate UDP.
Question 5: While interactively monitoring a system with the `top` command, a system administrator wants to sort the list of processes by memory consumption to identify which applications are using the most RAM. Which key should be pressed?
- `P`
- `M` (Correct answer)
- `k`
- `u`
Correct answer: `M`
Within the `top` interface, pressing the uppercase `M` key will immediately resort the process list to show the processes consuming the most resident memory at the top.
Question 6: A server unexpectedly rebooted overnight. To investigate the cause, an administrator needs to examine the journald logs from the boot session that occurred *before* the current one. Which command will display these specific logs?
- `journalctl --since "yesterday"`
- `journalctl -k`
- `journalctl -b -1` (Correct answer)
- `cat /var/log/dmesg.0`
Correct answer: `journalctl -b -1`
The `journalctl` command uses the `-b` flag to filter logs by boot session. `-b 0` or just `-b` refers to the current boot. `-b -1` refers to the immediately preceding boot, making it the correct choice for investigating events that led to the last reboot.
Free Linux+ System Monitoring and Logging Questions and Answers 1
A system administrator notices that systemd journal logs are being cleared after every reboot.
Which of the following actions will ensure logs are stored persistently across reboots?