Review System Journal Entries

Question 1

What command is used to display only log events that originate from the systemd PID 1 process?

Answer 1

journalctl _PID=1

Question 2

What command displays all log events that orignated from a system service with a UID of 81?

Answer 2

journalctl _UID=81

Question 3

What command displays log events with a warning or higher priority?

Answer 3

journalctl -p warning

Question 4

What command displays all recorded log events in the past 10 minutes from the current time?

Answer 4

journalctl –since “-10min”

Question 5

What command displays all the recorded log events that orginated from the sshd service since 09:00:00 this morning?

Answer 5

journalctl –since 9:00:00 _SYSTEMD_UNIT=”sshd.service”