Linux+ Linux+ System Monitoring and Logging 3

Question 1

Which command would you use to watch changes to a file in real time, following log output as it is appended?

Accepted Answer

tail -f

Answer

tail -f continuously outputs new lines appended to a file, making it ideal for live log monitoring.

Question 2

What is the primary purpose of the auditd daemon?

Accepted Answer

Recording security-relevant system calls and file access

Answer

auditd is the Linux Audit daemon that records security-relevant events like system calls, file accesses, and authentication attempts.

Question 3

Which vmstat field indicates the number of processes waiting for run time (blocked)?

Accepted Answer

b

Answer

The 'b' field in vmstat shows the number of processes in uninterruptible sleep, typically waiting for I/O.

Question 4

An administrator needs to search the systemd journal for all entries from the last 30 minutes. Which command accomplishes this?

Accepted Answer

journalctl --since '30 minutes ago'

Answer

The --since option accepts human-readable time expressions like '30 minutes ago' to filter journal entries.

Question 5

Which file contains the current kernel ring buffer messages, equivalent to running dmesg?

Accepted Answer

/proc/kmsg

Answer

/proc/kmsg is the kernel's message ring buffer that dmesg reads from to display kernel messages.

Linux Practice Test