System monitoring Flashcards

1
Q

log

A

records system events. startup, driver loaded, logon. time of event, user who caused it, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

the act of creating logs

A

logging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

where is the Windows log?

A

The Event Viewer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

some reasons to use event viewer:

A

curious, crashing game, logon, first step.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what to type in run box to get event viewer:

A

eventvwr.msc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what does the default view of Event Viewer show?

A

the summary of potentially important recent events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what can you see in the left hand pane of event viewer?

A

a few different groups of event types?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is custom views in event viewr?

A

you can make a filter that will look across all event logs and get what you want, specifically, rather than digging through everything you don’t want.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

how do you make a custom view of error severtity and critical or higher events logged in the last hour?

A

create custom view in right hand actions pane, filter, error and critical checkboxes, log: drop down menu: last hour, event logs: Windows logs. Ok. View:, View name:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what are Windows category logs?

A

event logs applying to the whole OS. driver issues during startup, for example.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

where are security logs?

A

in windows log category logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are applications and service logs?

A

logs that track events from a single application or os component instead of the system-wide events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

where could you check if you were having trouble with PowerShell and wanted information about it?

A

applications and services, PowerShell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what does each line in a given log in the Event Viewer represent?

A

an event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what does each event contain?

A

information grouped in columns about the event. logging level, information, critical, date and time, detailed info if event is selected, in the bottom of the event viewr.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

why look at more detailed info?

A

to dig into troubleshooting or give context for a bug report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Where are logs in Linux stored

A

/var/log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what does /var stand for?

A

Variable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are variable files

A

files that constantly change

20
Q

why are logs kept in the /var folder?

A

they’re constantly changing

21
Q

what is /var/log/auth.log?

A

authorization, Security related events

22
Q

what is /var/log/kern.log?

A

Kernel messages

23
Q

what is /var/log/dmesg

A

System start up messages

24
Q

What log file on a Linux system logs pretty much every log on your system

A

/var/log/syslog

25
what does syslog not log by default?
off events
26
what should be your first stop when looking at Linux logs if you don't have a very specific idea of what is the problem?
/var/log/syslog
27
How does Linux clean out old log files to make room for new ones
log rotation, Log rotate,
28
How can you make sure that you have access to logs from a month ago
change your log rotation settings in Linux So that your machine won't delete your old logs
29
What is centralized logging used for
managing multiple machines and trying to see the logs from each of those machines
30
What is the first field in an event log
the time stamp when an event occurred
31
What is a long string of numbers sort of time stamp format called? ex 150-153-8594
Unix epoch time
32
What is unix epoch time used to represent
Number of seconds since midnight on January first nineteen seventy, For unix based computers to anchor their concept of time out of Coordinated universal time, utC
33
Log rotate supplemental reading link
https://manpages.ubuntu.com/manpages/oracular/en/man8/logrotate.8.html
34
but command rotates compresses and mails system logs
logrotate
35
What does the force parameter do for log rotate
forces log rotate to force the rotation even if it doesn't think this is necessary
36
What is the first thing that you look for if you're not sure what the issue is
the word error
37
what if you're saying an issue with a specific application what can you search for?
the application name in the logs
38
how to get error from logs in Linux:
less /var/log/syslog | grep error
39
how do you check timestamps for errors that happened at a specific time?
less /var/log/syslog , and look for the right timestamp
40
What should you do would you get to a log portion that might help you uncover the problem that you're looking for?
start looking at the output from either the top or bottom
41
What happens if you resolve a root issue
you resolve the problems it causes
42
When do you want to work from the bottom up?
if you weren't seeing any issues you can figure it in the log so you can figure things out if you come across a clue
43
How can you look at logs in real time
tail command
44
tail -f /var/log/syslog
keep in an open window, and make an event happen, watch the events that get logged to track in real time.
45
what must be true to connect ssh to a client?
ssh is installed on client, ssh server is running on host you want to connect to, you need to specify a hostname to ssh into