You are analyzing auditd logs and find a record with type=SYSCALL and syscall=257. You need to determine what this syscall does. What is the most efficient way to identify it?

Use the 'ausearch -sc 257' command to get the name.

Assume it is the same as on other systems.

Check the auditd configuration file for a mapping.

Look up syscall number 257 in the architecture-specific syscall table.

You are investigating a Linux server that has both journald and rsyslog running. You need to determine if a specific event was logged by both sources. The event is a kernel-level error. Which source is more likely to have captured it?

rsyslog, because it is the traditional syslog daemon.

Neither, because kernel errors are not logged.

journald, because it captures kernel messages from the kernel ring buffer.

Both are equally likely, because they both read from /proc/kmsg.

GIAC Linux Incident Responder

Domain 2Objective 2

Analyzing Linux Events GLIR Practice Questions (Page 3)

Part of the Event Log Analysis and Timeline Analysis domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 5–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 11–15

11application · medium
An incident responder is analyzing a journald log entry that shows a timestamp of 1710000000. The system's timezone is UTC+2. What is the correct local time of this event?
Select an answer first
12expert · hard
You are analyzing auditd logs and find a record with type=SYSCALL and syscall=257. You need to determine what this syscall does. What is the most efficient way to identify it?
Select an answer first
13foundation · easy
Which tool is specifically designed to query auditd logs for security events?
Select an answer first
14foundation · easy
Which of the following is an ISO 8601 formatted timestamp?
Select an answer first
15expert · hard
You are investigating a Linux server that has both journald and rsyslog running. You need to determine if a specific event was logged by both sources. The event is a kernel-level error. Which source is more likely to have captured it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Analyzing Linux Events GLIR Practice Questions (Page 3)

Questions 11–15

An incident responder is analyzing a journald log entry that shows a timestamp of 1710000000. The system's timezone is UTC+2. What is the correct local time of this event?

You are analyzing auditd logs and find a record with type=SYSCALL and syscall=257. You need to determine what this syscall does. What is the most efficient way to identify it?

Which tool is specifically designed to query auditd logs for security events?

Which of the following is an ISO 8601 formatted timestamp?

You are investigating a Linux server that has both journald and rsyslog running. You need to determine if a specific event was logged by both sources. The event is a kernel-level error. Which source is more likely to have captured it?

Keep studying — Event Log Analysis and Timeline Analysis