A system administrator is investigating a security incident and needs to find all journal messages from the last 24 hours that were logged with a priority of 'err' or higher, but only from the 'sshd' and 'sudo' units. Which journalctl command would be most efficient?

journalctl -p err -u sshd --since "24 hours ago"

journalctl -p err --since "24 hours ago" -u sshd -u sudo

journalctl -u sshd -u sudo --since "24 hours ago" | grep -E 'err|crit|alert|emerg'

A system administrator needs to find all journal messages from the previous boot that contain the string 'disk error'. Which journalctl command should be used?

journalctl -b -1 | grep 'disk error'

journalctl --since "yesterday" | grep 'disk error'

journalctl -b | grep 'disk error'

A Linux administrator needs to review the systemd journal for messages from the SSH service (sshd) that were logged in the last 30 minutes. Which journalctl command would accomplish this?

journalctl -u sshd --until "30 minutes ago"

journalctl _SYSTEMD_UNIT=sshd --since "30 minutes ago"

journalctl -u sshd --since "30 minutes ago"

LPI LPIC-1:Linux Administrator (101-500)

Domain 8Objective 2

108.2 System Logging LPIC-1 Practice Questions (Page 1)

Part of the Topic 108: Essential System Services domain, which makes up ~9% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

Questions 1–5

1expert · hard
A system administrator is investigating a security incident and needs to find all journal messages from the last 24 hours that were logged with a priority of 'err' or higher, but only from the 'sshd' and 'sudo' units. Which journalctl command would be most efficient?
Select an answer first
2application · medium
A system administrator needs to find all journal messages from the previous boot that contain the string 'disk error'. Which journalctl command should be used?
Select an answer first
3foundation · easy
Which rsyslog configuration directive enables the daemon to listen for remote syslog messages over UDP?
Select an answer first
4application · medium
A Linux administrator needs to review the systemd journal for messages from the SSH service (sshd) that were logged in the last 30 minutes. Which journalctl command would accomplish this?
Select an answer first
5foundation · easy
In an rsyslog configuration, which action would send log messages to a remote syslog server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-1

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-1” is a trademark of its owner, used for identification only.

108.2 System Logging LPIC-1 Practice Questions (Page 1)

Questions 1–5

A system administrator is investigating a security incident and needs to find all journal messages from the last 24 hours that were logged with a priority of 'err' or higher, but only from the 'sshd' and 'sudo' units. Which journalctl command would be most efficient?

A system administrator needs to find all journal messages from the previous boot that contain the string 'disk error'. Which journalctl command should be used?

Which rsyslog configuration directive enables the daemon to listen for remote syslog messages over UDP?

A Linux administrator needs to review the systemd journal for messages from the SSH service (sshd) that were logged in the last 30 minutes. Which journalctl command would accomplish this?

In an rsyslog configuration, which action would send log messages to a remote syslog server?

Keep studying — Topic 108: Essential System Services