LFCS Certification LFCS Log Management and Monitoring

Question 1

Which journalctl option shows all log entries from the current boot?

Accepted Answer

journalctl -b

Answer

journalctl -b filters the journal to only entries from the current (or a numbered past) boot session.

Question 2

How do you stream new journal entries in real time, similar to `tail -f`?

Accepted Answer

journalctl -f

Answer

journalctl -f follows the journal and prints new entries as they arrive, just like tail -f does for plain log files.

Question 3

Which journalctl option filters output to only show entries from a specific systemd unit, e.g., sshd.service?

Accepted Answer

-u / --unit=

Answer

journalctl -u sshd.service (or --unit=sshd.service) limits output to journal entries generated by that unit.

Question 4

Where does systemd-journald store persistent journal data by default?

Accepted Answer

/var/log/journal/

Answer

/var/log/journal/ holds persistent journal files; if this directory does not exist, logs are stored in /run/log/journal/ and lost on reboot.

Question 5

Which journalctl option shows entries logged after a specified time, such as 'yesterday' or '2 hours ago'?

Accepted Answer

--since

Answer

journalctl --since='2 hours ago' (or a specific timestamp) limits output to entries logged after that point in time.

LFCS Certification Practice Test