Logs

Question 1

Where are log messages located?

Answer 1

/var/log

Question 2

Where are ssh login logs stored?

Answer 2

/var/log/secure

Question 3

Where are system logs stored?

Answer 3

/var/log/messages

Question 4

What is journald?

Answer 4

journal daemon for systemd

Aggregates logs across system into one location

Question 5

How do you get the man page for journald?

Answer 5

man systemd-journald

Question 6

How do you access journals?

Answer 6

journalctl

• x Additional information
• f Follow
• dumps all information inside journal daemon

Question 7

Where are journal messages stored by default?

Answer 7

/run/log/journal
*/run directory is ephemeral like var (not persistent)

Question 8

How would you make journal messages persistent?

Answer 8

Edit /etc/systemd/journald.conf
Storage=persistent
systemctl restart systemd-journald
*journal messages will be stored /var/log/journal

Question 9

How can you get information on the boot performance?

Answer 9

systemd-analyze
systemd-analyze blame
*blame details how long each unit configuration file took

Question 10

What determines the log level for logs?

Answer 10

/etc/rsyslog.conf

Question 11

What are the different log levels?

Answer 11

“emerg” (0), “alert” (1), “crit” (2), “err” (3), “warning” (4), “notice” (5), “info (6), “debug” (7)
i.e journalctl -p info