Linux+ Linux+ System Monitoring and Logging 3 — Questions and Answers
Question 1: Which command would you use to watch changes to a file in real time, following log output as it is appended?
- cat -f
- tail -f (Correct answer)
- watch cat
- head -n +1
Correct answer: tail -f
tail -f continuously outputs new lines appended to a file, making it ideal for live log monitoring.
Question 2: What is the primary purpose of the auditd daemon?
- Compressing old log files
- Recording security-relevant system calls and file access (Correct answer)
- Rotating logs weekly
- Monitoring CPU performance
Correct answer: Recording security-relevant system calls and file access
auditd is the Linux Audit daemon that records security-relevant events like system calls, file accesses, and authentication attempts.
Question 3: Which vmstat field indicates the number of processes waiting for run time (blocked)?
- r
- b (Correct answer)
- wa
- id
Correct answer: b
The 'b' field in vmstat shows the number of processes in uninterruptible sleep, typically waiting for I/O.
Question 4: An administrator needs to search the systemd journal for all entries from the last 30 minutes. Which command accomplishes this?
- journalctl --since '30 minutes ago' (Correct answer)
- journalctl -n 30m
- journalctl --tail=30m
- journalctl -p 30
Correct answer: journalctl --since '30 minutes ago'
The --since option accepts human-readable time expressions like '30 minutes ago' to filter journal entries.
Question 5: Which file contains the current kernel ring buffer messages, equivalent to running dmesg?
- /var/log/kern.log
- /proc/kmsg (Correct answer)
- /sys/kernel/debug/log
- /var/log/dmesg
Correct answer: /proc/kmsg
/proc/kmsg is the kernel's message ring buffer that dmesg reads from to display kernel messages.
Question 6: What does the sar command stand for, and which package provides it on most Linux distributions?
- System Audit Reporter, audit-tools
- System Activity Reporter, sysstat (Correct answer)
- Service Analysis Report, systemd-tools
- Storage Access Reader, util-linux
Correct answer: System Activity Reporter, sysstat
sar stands for System Activity Reporter and is part of the sysstat package, collecting and reporting system performance data.
Question 7: Which signal should be sent to syslogd or rsyslogd to make it re-read its configuration file without restarting?
- SIGKILL
- SIGTERM
- SIGHUP (Correct answer)
- SIGUSR1
Correct answer: SIGHUP
Sending SIGHUP to rsyslogd causes it to reload its configuration file and reopen log files without a full restart.
Linux+ Linux+ System Monitoring and Logging 3
Which command would you use to watch changes to a file in real time, following log output as it is appended?