System logs (/var/log) in Linux CLI - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to view the last 10 lines of the system log file /var/log/syslog.

Linux CLI

tail [1] 10 /var/log/syslog

Drag options to blanks, or click blank then click option'

A-f

B-r

C-n

D-c

Attempts:

3 left

💡 Hint

Common Mistakes

Using -f instead of -n which follows the file continuously.

Using -r which reverses the output order.

Using -c which shows bytes instead of lines.

The tail -n 10 shows the last 10 lines from the end of the file.

2fill in blank

medium

Complete the command to search for the word error in the /var/log/auth.log file, ignoring case.

Linux CLI

grep [1] error /var/log/auth.log

Drag options to blanks, or click blank then click option'

A-i

B-v

C-c

D-n

Attempts:

3 left

💡 Hint

Common Mistakes

Using -v which inverts the match.

Using -c which counts matches instead of showing them.

Using -n which shows line numbers but does not ignore case.

The -i option makes grep ignore case, so it finds 'error', 'Error', or 'ERROR'.

3fill in blank

hard

Fix the error in the command to continuously monitor the /var/log/kern.log file for new entries.

Linux CLI

tail [1] /var/log/kern.log

Drag options to blanks, or click blank then click option'

A-f

B-n 20

C-r

D-c 100

Attempts:

3 left

💡 Hint

Common Mistakes

Using -n 20 which only shows last 20 lines once.

Using -r which reverses the output order.

Using -c 100 which shows bytes, not lines.

The -f option makes tail follow the file and show new lines as they are added.

4fill in blank

hard

Fill both blanks to create a command that counts how many times the word failed appears in /var/log/auth.log.

Linux CLI

grep [1] failed /var/log/auth.log | wc [2]

Drag options to blanks, or click blank then click option'

A-i

B-l

D-c

Attempts:

3 left

💡 Hint

Common Mistakes

Using grep -l which lists filenames, not matches.

Using wc -c which counts bytes, not lines.

Use grep -i to find 'failed' ignoring case, then wc -l to count the matching lines.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension in Python that maps each log filename in logs to its size in bytes, but only if the size is greater than 1000.

Linux CLI

sizes = { [1]: os.path.getsize([2]) for [3] in logs if os.path.getsize([2]) > 1000}

Drag options to blanks, or click blank then click option'

Alog

Dfilename

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names inconsistently.

Using a variable not defined in the loop.

Use the variable log as the key and value source in the comprehension. It represents each filename in the logs list.

Practice

1. What is the primary purpose of files located in the /var/log/ directory on a Linux system?

easy

A. To hold user personal documents and files

B. To contain system configuration files

C. To save temporary files created during program execution

D. To store system and application logs recording events and errors

Solution

1. Step 1: Understand the role of /var/log/

   The /var/log/ directory is designed to keep logs about system and application activities.

2. Step 2: Differentiate from other directories

   Other directories like /home store user files, /etc holds configs, and /tmp stores temporary files.

3. Final Answer:

   To store system and application logs recording events and errors -> Option D

4. Quick Check:

   /var/log/ = system logs [OK]

Hint: Remember: /var/log holds logs, not configs or user files [OK]

Common Mistakes:

• Confusing /var/log with /etc for configs
• Thinking /var/log stores user documents
• Mixing up temporary files with logs

2. Which command correctly displays the last 10 lines of the /var/log/syslog file?

easy

A. tail /var/log/syslog

B. head /var/log/syslog

C. cat /var/log/syslog | head

D. less /var/log/syslog

Solution

1. Step 1: Recall command functions

   The tail command shows the last lines of a file; by default, it shows the last 10 lines.

2. Step 2: Compare options

   head shows the first lines, cat | head also shows first lines, and less opens a pager for browsing but does not directly show last lines.

3. Final Answer:

   tail /var/log/syslog -> Option A

4. Quick Check:

   tail = last 10 lines [OK]

Hint: Use tail to see last lines quickly [OK]

Common Mistakes:

• Using head instead of tail for last lines
• Confusing less with tail output
• Piping cat to head for last lines

3. What will be the output of the command grep 'error' /var/log/syslog | wc -l?

medium

A. It displays all lines from /var/log/syslog except those with 'error'

B. It shows the number of lines containing the word 'error' in /var/log/syslog

C. It counts all words in /var/log/syslog

D. It shows the first line containing 'error' in /var/log/syslog

Solution

1. Step 1: Understand grep and wc -l

   grep 'error' /var/log/syslog filters lines containing 'error'. wc -l counts the number of lines from that output.

2. Step 2: Combine command effects

   The pipeline counts how many lines in syslog have the word 'error'.

3. Final Answer:

   It shows the number of lines containing the word 'error' in /var/log/syslog -> Option B

4. Quick Check:

   grep + wc -l = count matching lines [OK]

Hint: grep filters lines; wc -l counts them [OK]

Common Mistakes:

• Thinking grep excludes matching lines
• Confusing wc -l with word count
• Assuming output shows lines, not count

4. You run tail -n 20 /var/log/auth.log but get an error: "tail: cannot open '/var/log/auth.log' for reading: Permission denied". What is the best way to fix this?

medium

A. Run the command with sudo: sudo tail -n 20 /var/log/auth.log

B. Change the file permissions with chmod 777 /var/log/auth.log

C. Copy the file to your home directory and run tail there

D. Use head instead of tail

Solution

1. Step 1: Identify permission issue

   The error says permission denied, meaning the user lacks rights to read the file.

2. Step 2: Use elevated privileges safely

   Using sudo runs the command as root, allowing access without changing file permissions.

3. Final Answer:

   Run the command with sudo: sudo tail -n 20 /var/log/auth.log -> Option A

4. Quick Check:

   Permission denied? Use sudo [OK]

Hint: Use sudo for restricted log files [OK]

Common Mistakes:

• Changing permissions insecurely with chmod 777
• Copying files without permissions
• Using head instead of fixing permissions

5. You want to monitor new entries added to /var/log/syslog in real-time and filter only lines containing the word 'failed'. Which command achieves this?

hard

A. cat /var/log/syslog | tail -f

B. grep failed /var/log/syslog

C. tail -f /var/log/syslog | grep failed

D. less /var/log/syslog | grep failed

Solution

1. Step 1: Understand real-time monitoring

   tail -f shows new lines added to a file live as they appear.

2. Step 2: Filter output for 'failed'

   Piping tail -f output to grep failed shows only lines containing 'failed' in real-time.

3. Final Answer:

   tail -f /var/log/syslog | grep failed -> Option C

4. Quick Check:

   tail -f + grep = live filtered log [OK]

Hint: Use tail -f piped to grep for live filtered logs [OK]

Common Mistakes:

• Using grep alone shows only current matches, no live updates
• Using cat with tail -f incorrectly
• Trying to grep inside less which is not live