journalctl for systemd logs in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this journalctl command?

You run the command journalctl -u sshd.service --since "2024-06-01 00:00:00" --until "2024-06-01 01:00:00". What does this command show?

Linux CLI

journalctl -u sshd.service --since "2024-06-01 00:00:00" --until "2024-06-01 01:00:00"

A Logs from the sshd service between midnight and 1 AM on June 1, 2024

B Logs from all services between midnight and 1 AM on June 1, 2024

C Logs from the sshd service for the entire day of June 1, 2024

D Logs from the sshd service only for June 1, 2023

💡 Hint

Look at the -u option for service and the --since and --until for time range.

The -u option filters logs for the sshd service only. The --since and --until options limit logs to the specified time range on June 1, 2024.

💻 Command Output

intermediate

What does this journalctl command output?

You run journalctl -p err -b. What logs are shown?

Linux CLI

journalctl -p err -b

A All logs from the previous boot with priority error or higher

B All logs from the current boot with priority info or lower

C All logs from the current boot with priority error or higher

D All logs from all boots with priority error or higher

💡 Hint

Check what -p and -b options mean.

The -p err filters logs with priority error or higher (error, critical, alert, emergency). The -b option limits logs to the current boot.

🔧 Debug

advanced

Why does this journalctl command fail?

You try to run journalctl --since 2024-06-01 --until 2024-06-01 23:59:59 but get an error. What is the problem?

Linux CLI

journalctl --since 2024-06-01 --until 2024-06-01 23:59:59

A The --since date is missing the time part

B The date format is invalid; it needs slashes instead of dashes

C The command needs a service specified with -u

D The --until date and time must be quoted because of the space

💡 Hint

Look carefully at the space in the --until argument.

The shell treats the space as a separator, so the date and time for --until must be quoted to be one argument.

🚀 Application

advanced

How to show only kernel messages with journalctl?

You want to see only kernel messages from the current boot using journalctl. Which command achieves this?

A journalctl -k -b

B journalctl -u kernel -b

C journalctl --kernel -b

D journalctl -p kernel -b

💡 Hint

Check the option for kernel messages in journalctl.

The -k option shows kernel messages. The -b limits to current boot. The other options are invalid or do not filter kernel logs.

🧠 Conceptual

expert

What is the effect of running journalctl --vacuum-time=2d?

You run journalctl --vacuum-time=2d. What happens to the system logs?

A Only logs from the last 2 days are shown

B Logs older than 2 days are deleted to free disk space

C Logs are archived every 2 days

D Logs are compressed if older than 2 days

💡 Hint

Think about what vacuum means in journalctl context.

The --vacuum-time option deletes journal logs older than the specified time to save disk space.

Practice

1. What is the primary purpose of the journalctl command in Linux?

easy

A. To edit configuration files for systemd services

B. To start and stop systemd services

C. To view system and service logs managed by systemd

D. To display disk usage statistics

Solution

1. Step 1: Understand the role of journalctl

   The journalctl command is used to access logs collected by systemd's journal service.

2. Step 2: Compare options with command purpose

   Editing configuration files, starting/stopping services, and displaying disk usage are handled by other commands, unrelated to viewing logs.

3. Final Answer:

   To view system and service logs managed by systemd -> Option C

4. Quick Check:

   journalctl = view logs [OK]

Hint: Remember: journalctl = journal + control = view logs [OK]

Common Mistakes:

• Confusing journalctl with systemctl for service control
• Thinking journalctl edits files
• Assuming journalctl shows disk info

2. Which of the following is the correct syntax to show the last 10 lines of system logs using journalctl?

easy

A. journalctl -n 10

B. journalctl --last 10

C. journalctl -l 10

D. journalctl -t 10

Solution

1. Step 1: Recall journalctl option for number of lines

   The -n option followed by a number shows that many recent log lines.

2. Step 2: Check other options for correctness

   The other options are not valid journalctl options for limiting output lines.

3. Final Answer:

   journalctl -n 10 -> Option A

4. Quick Check:

   -n = number of lines [OK]

Hint: Use -n to limit lines shown quickly [OK]

Common Mistakes:

• Using --last instead of -n
• Confusing -l (line wrap) with line count
• Using -t which filters by syslog identifier

3. What will be the output of the command journalctl -u sshd.service -n 3?

medium

A. Shows the last 3 log entries related to the sshd service

B. Shows all logs except those from sshd service

C. Shows the first 3 lines of the system log

D. Shows logs from all services except sshd

Solution

1. Step 1: Understand the -u option

   The -u sshd.service option filters logs to only those from the sshd service.

2. Step 2: Understand the -n 3 option

   The -n 3 option limits output to the last 3 log entries.

3. Final Answer:

   Shows the last 3 log entries related to the sshd service -> Option A

4. Quick Check:

   -u sshd + -n 3 = last 3 sshd logs [OK]

Hint: -u filters by service, -n limits lines [OK]

Common Mistakes:

• Thinking -u excludes the service logs
• Confusing -n with showing first lines
• Assuming it shows all logs

4. You run journalctl -u nginx.service --since "2024-01-01" --until "2024-01-02" but get no output, even though you know nginx was active. What is the likely problem?

medium

A. The date format is incorrect; journalctl requires YYYY-MM-DD HH:MM:SS

B. The service name is wrong; it should be nginx without .service

C. The journal is empty because logging is disabled

D. The system clock is set to a different timezone causing no matching logs

Solution

1. Step 1: Check date format validity

   The date format "YYYY-MM-DD" is valid for journalctl; it does not require HH:MM:SS.

2. Step 2: Consider timezone impact

   If the system clock or journal timestamps use a different timezone, the specified range may not match any logs, causing no output.

3. Step 3: Verify service name and logging

   The service name with .service is correct, and nginx is usually logged to the journal, making incorrect service name or disabled logging unlikely.

4. Final Answer:

   The system clock is set to a different timezone causing no matching logs -> Option D

5. Quick Check:

   Timezone mismatch = no logs in range [OK]

Hint: Check timezone if date filters show no logs [OK]

Common Mistakes:

• Assuming date format is wrong
• Removing .service from unit name
• Ignoring system clock timezone

5. You want to monitor live logs from the docker.service as they happen. Which command should you use?

hard

A. journalctl -u docker.service --since now

B. journalctl -u docker.service -f

C. journalctl -u docker.service -n 0

D. journalctl -u docker.service --no-pager

Solution

1. Step 1: Identify option for live log streaming

   The -f option in journalctl streams new log entries live, similar to tail -f.

2. Step 2: Evaluate other options

   journalctl -u docker.service --since now shows logs since now but does not follow live updates. journalctl -u docker.service -n 0 shows zero lines, so no output. journalctl -u docker.service --no-pager disables paging but does not stream live.

3. Final Answer:

   journalctl -u docker.service -f -> Option B

4. Quick Check:

   -f = follow live logs [OK]

Hint: Use -f to follow logs live like tail -f [OK]

Common Mistakes:

• Using --since now without -f for live updates
• Using -n 0 which shows no lines
• Confusing --no-pager with live streaming