Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

RHCSA Commands > Sylog > Flashcards

Sylog Flashcards

1
Q

What are the systemd built-in logging frameworks?

A

1) systemd-journald
2) rsyslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Diff between:

1) systemd-journald
2) rsyslog

A

1) systemd-journald: stores journal in db
2) rsyslog: logs to /var/log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you query the systemd-journald database?

A

Use journalctl command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

which of these logging framework implements the syslog protocol:

1) systemd-journald
2) rsyslog

A

Both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

In syslog every event has two elements to it. Name them

A

1) Facility
2) Priority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are some well known facilities

A

mail
authpriv
cron
kern
daemon
news
syslog
uucp
ftp
lpr
auth
local0 to local7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some well known priorities?

A

debug
info
notice
warn
error
crit
alert
emerg

(Experts Alert: Diagnosing issues Needs Wise Error Checking)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is the daemon responsible for systemd-journald?

A

systemd-journald

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is the daemon responsible for rsyslog?

A

rsyslog NOT rsyslogd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where are rsyslog config stored?

A

/etc/rsyslog.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do rsyslog rules capture?

A

Which message goes to which file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

General rule format of a rsyslog rule

A

FACILITY.PRIORITY[;EXCEPTED_FACILITY.none]* [-]/target/file

FACILITY.PRIORITY is called SELECTOR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the effect of a dash in front of a log file in /etc/rsyslog.conf

A

The dash causes the logs to be written asynchornously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is the rsyslog drop in folder?

A

/etc/rsyslog.d/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do you get help with rsyslog.conf?

A

man rsyslog.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where do you put rsyslog custom configs?

A

Create a file and drop them in /etc/rsyslog.d/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the user definable facilities?

A

local0 to local7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Create a custom rsyslog rule for sshd

A 
echo 'SyslogFacility local6' > /etc/sshd_config.d/99-logging.conf
echo 'local6.*.   /var/log/ssh.log'  >> /etc/rsyslog.d/99-sshd.conf
systemctl restart sshd rsylog
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Send a log message manually as the facility SSHD with priority INFO

A

logger -p local6.info ‘here is the message’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

By default, where are journals logged?

A

By default they are not logged. The volatile journal is used and saved in

/run/log/journal

which is deleted on reboot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

View the content of the journal on stdout

A

journatlctl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the order of journalctl messages?

A

oldest to newest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How do you view journal messages from newest to oldest

A

journalctl -r

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

journalctl -f

A

stream the journal to stdout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Filter journal messages by priority and by unit

A 
journalctl -p err -u ssd
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Filter journal messages by date range

A 
journalctl --since "2023-11-05 10:20:12"  --until "2023-11-05 10:30:12"
journalctl --since "-1 hour"
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the process with PID 1?

A

systemd

28
Q

Print all journal by facility with PID 1

A

journaltcl _PID=1

29
Q

Print all journal by user with ID 81

A 
journaltcl _UID=1
30
Q

How do you get help on journald

A

man journald.conf

31
Q

What are storage options for journald?

A

auto (default)
volatile
none
persistent

32
Q

Make journal persistent

A

In /etc/systemd/journald.conf

Storage=persistent

systemctl restart systemd-journald
33
Q

List all journalctl boots

A 
journalctl --list-boots
34
Q

List journatlctl messages for a certain boot

A

journalctl -b 1

35
Q

Display comprehensive time information on your server

A

timedatectl

36
Q

What timezones are available so I may pick one

A

timedatectl list-timezones

37
Q

Set timezone to Africa/Douala

A

timedatectl set-timezone Africa/Douala

38
Q

Activate time synchronization

A 
timedatectl set-ntp true
39
Q

What is the time synchronization daemon?

A

chronyd (replaces ntpd)

40
Q

Determine chronyd date sources

A 
chronyc sources
41
Q

what is tzselect

A

Timezone Select: utility that allows selection of time zone by menu navigation.

42
Q

What are key system log files?

A

1) /var/log/messages
2) /varlog/secure
3) /var/log/cron
4) /var/log/maillog
5) /var/log/boot.log

43
Q

What happens if a message is matched by many rules in rsyslog.conf?

A

The message is stored in all files with matching rule

44
Q

none keyword in rsyslog.conf

A

indicates that no messages for the indicated facility are stored in the given file

45
Q

Explain logrotate command

A

rotates log files to prevent them from taking too much space in the /var/log

46
Q

key to successful use of the journal for troubleshooting and auditing

A

limit journal searches to show only relevant output.

47
Q

Show 5 last entries of journal

A

journalctl -n 5

48
Q

Different ways of filtering jorunalctl output

A

1) limit size with n option
2) tail with -f option
3) filter with since and until
4) filer by PID, UID, priority, user
5) filter by verbose field

49
Q

Determine fields that you can filter journalctl output with

A

journalctl -o verbose

50
Q

Popular journalctl fields that can be used for filter events

A

_COMM is the command name.
_EXE is the path to the executable file for the process.
_PID is the PID of the process.
_UID is the UID of the user that runs the process.
_SYSTEMD_UNIT is the systemd unit that started the process.

51
Q

Explain volatile storage option

A

Stores journals in the volatile /run/log/journal directory

52
Q

Explain auto storage option

A

If /var/log/journal exists, then persistent storage is used; otherwise it uses volatile is used.

53
Q

Explain persistent storage option

A

Stores journals in /var/log/journal. If directory does not exist, then create it

54
Q

How is journal data rotated?

A

journal has a built-in log rotation mechanism that triggers monthly

55
Q

retrieves the entries from the current system boot only

A

journalctl -b

56
Q

limits the output to only the previous boot

A

journalctl -b -1

57
Q

Set time to 9:00:00

A

timedatectl set-time 9:00:00

58
Q

stratum

A

number of hops that the machine is away from a high-performance reference clock

59
Q

driftfile

A

a file (configured in /etc/chrony.conf) in which chronyd records the rate at which the RTC looses or gains time

60
Q

what categories of time sources can you declare in /etc/chrony.conf

A

peer (same stratum)
server (one level above)

61
Q

Example server configuration in /etc/chrony.conf

A 
server classroom.example.com iburst
62
Q

tar -p option

A

preserve permissions

63
Q

tar –selinux option

A

: Enable SELinux context support, and store SELinux file contexts.

64
Q

tar -a option

A

–auto-compress : Use the archive’s suffix to determine the algorithm to use

65
Q

Explain ownership of extracted files

A

if root user extracts an archive, the original users and group ownership are preserved

if regular user extracts an archive, he becomes the owner

66
Q

How are permissions of extracted files determined?

A

if -p was used, then the original permissions are maintained otherwise, umask is used to determine the permissions.

RHCSA Commands (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions