Linux Logging Quiz: System Logging (Linux+) Mastery

1. In rsyslog, what does the 'none' priority mean when used in a facility.priority rule?

No logs are processed

Exclude this facility from logging

Log all priorities for this facility

Only log critical messages

2. What is the purpose of log rotation in Linux logging systems?

Prevent log files from consuming excessive disk space

Encrypt sensitive log data

Send logs to remote servers

Compress all logs automatically

3. How do you display journalctl logs from a specific PID (process ID)?

Journalctl _PID=1234

Journalctl --pid 1234

Journalctl -p 1234

Journalctl --process=1234

4. In rsyslog, what does the 'imklog' module handle?

Kernel log messages

File input monitoring

UDP syslog reception

TCP syslog reception

5. Which journalctl option exports logs in JSON format for programmatic parsing?

-o json

-o json-pretty

-f json

--format=json

6. What rsyslog action sends logs to a remote syslog server on port 514?

@hostname

@@hostname

#hostname

&hostname

7. How do you query journalctl for all messages from a specific systemd unit?

Journalctl -u nginx.service

Journalctl --unit=nginx

Journalctl -s nginx.service

Journalctl --service nginx

8. In journald, which field stores the executable name that generated the log entry?

_COMM

_EXE

_CMDLINE

_SYSTEMD_UNIT

9. What is the primary configuration file for rsyslog on most Linux systems?

/etc/syslog.conf

/etc/rsyslog.conf

/etc/journald.conf

/etc/log.conf

10. Which command shows detailed metadata about a specific journal entry, including binary fields?

Journalctl -o json

Journalctl -o verbose

Journalctl -o short

Journalctl -o cat

11. Which systemd component is responsible for centralized log management and replaces traditional syslog in modern Linux distributions?

Journald

Rsyslog

Auditd

Logrotate

12. How do you filter journalctl output to show logs from the last hour only?

Journalctl --since=1h

Journalctl --since="1 hour ago"

Journalctl -t 1h

Journalctl --hours=1

13. Which rsyslog module handles the standard syslog protocol (RFC 3164) reception?

Imudp

Imtcp

Imfile

Imklog

14. What configuration option in journald determines whether logs persist after reboot?

Storage=persistent

Storage=volatile

Compress=yes

RateLimitBurst=1000

15. In rsyslog configuration, what does the asterisk (*) in a priority field represent?

All facilities

All priorities

Wildcard for any character

Critical severity only

16. Which journalctl flag allows you to follow new log entries in real-time, similar to 'tail -f'?

-f

-F

-x

-a

17. What is the primary difference between journald and rsyslog in terms of log storage format?

Journald uses binary format; rsyslog uses plain text

Journald uses plain text; rsyslog uses binary format

Both use identical binary formats

Both use only plain text files

18. Which file stores persistent journald logs across system reboots?

/run/log/journal

/var/log/journal

/etc/journal

/tmp/journal

19. In rsyslog, what does the priority field in a facility.priority rule control?

The order of log processing

The minimum severity level to log

The destination file path

The network transmission speed

20. What command displays the last 50 journal entries in reverse chronological order?

Journalctl -n 50

Journalctl --tail=50

Journalctl -f

Journalctl -x

Linux Logging Quiz: Can You Master journald & rsyslog?