journalctl for systemd logs in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this journalctl command?

You run the command journalctl -u sshd.service --since "2024-06-01 00:00:00" --until "2024-06-01 01:00:00". What does this command show?

Linux CLI

journalctl -u sshd.service --since "2024-06-01 00:00:00" --until "2024-06-01 01:00:00"

A Logs from the sshd service between midnight and 1 AM on June 1, 2024

B Logs from all services between midnight and 1 AM on June 1, 2024

C Logs from the sshd service for the entire day of June 1, 2024

D Logs from the sshd service only for June 1, 2023

💡 Hint

Look at the -u option for service and the --since and --until for time range.

The -u option filters logs for the sshd service only. The --since and --until options limit logs to the specified time range on June 1, 2024.

💻 Command Output

intermediate

What does this journalctl command output?

You run journalctl -p err -b. What logs are shown?

Linux CLI

journalctl -p err -b

A All logs from the previous boot with priority error or higher

B All logs from the current boot with priority info or lower

C All logs from the current boot with priority error or higher

D All logs from all boots with priority error or higher

💡 Hint

Check what -p and -b options mean.

The -p err filters logs with priority error or higher (error, critical, alert, emergency). The -b option limits logs to the current boot.

🔧 Debug

advanced

Why does this journalctl command fail?

You try to run journalctl --since 2024-06-01 --until 2024-06-01 23:59:59 but get an error. What is the problem?

Linux CLI

journalctl --since 2024-06-01 --until 2024-06-01 23:59:59

A The --since date is missing the time part

B The date format is invalid; it needs slashes instead of dashes

C The command needs a service specified with -u

D The --until date and time must be quoted because of the space

💡 Hint

Look carefully at the space in the --until argument.

The shell treats the space as a separator, so the date and time for --until must be quoted to be one argument.

🚀 Application

advanced

How to show only kernel messages with journalctl?

You want to see only kernel messages from the current boot using journalctl. Which command achieves this?

A journalctl -k -b

B journalctl -u kernel -b

C journalctl --kernel -b

D journalctl -p kernel -b

💡 Hint

Check the option for kernel messages in journalctl.

The -k option shows kernel messages. The -b limits to current boot. The other options are invalid or do not filter kernel logs.

🧠 Conceptual

expert

What is the effect of running journalctl --vacuum-time=2d?

You run journalctl --vacuum-time=2d. What happens to the system logs?

A Only logs from the last 2 days are shown

B Logs older than 2 days are deleted to free disk space

C Logs are archived every 2 days

D Logs are compressed if older than 2 days

💡 Hint

Think about what vacuum means in journalctl context.

The --vacuum-time option deletes journal logs older than the specified time to save disk space.