LFCS Certification LFCS Log Management and Monitoring 2

Question 1

What is the default rsyslog main configuration file path?

Accepted Answer

/etc/rsyslog.conf

Answer

rsyslog reads /etc/rsyslog.conf at startup for its main configuration, including global settings and rules.

Question 2

In rsyslog filter syntax, which facility keyword represents kernel-generated messages?

Accepted Answer

kern

Answer

The 'kern' facility in syslog captures messages generated directly by the Linux kernel.

Question 3

Which rsyslog severity level is more critical than 'err' but less critical than 'alert'?

Accepted Answer

crit

Answer

Syslog severities in descending order are: emerg, alert, crit, err, warning, notice, info, debug — crit sits between alert and err.

Question 4

Which rsyslog rule forwards all facility/severity combinations to a remote UDP syslog server at 192.168.1.1?

Accepted Answer

*.* @192.168.1.1

Answer

In rsyslog, a single @ before the address means UDP; @@ means TCP — *.* @192.168.1.1 forwards everything over UDP.

Question 5

Where should application-specific rsyslog configuration snippets be placed?

Accepted Answer

/etc/rsyslog.d/

Answer

/etc/rsyslog.d/*.conf files are included by the main /etc/rsyslog.conf via an $IncludeConfig directive.

LFCS Certification Practice Test