System Logging Linux

Where are Linux system logs typically stored?

• /var/log/system_logs

• /var/log/syslog

• /var/logs/linux_logs

• /var/system_logs

Answer explanation

Explanation: Linux system logs are typically stored in the /var/log directory. Among the given options, /var/log/syslog is the correct location for system logs.

What does the /var/log/auth.log file store?

• System startup messages

• Kernel events and errors

• Security-related events like logins and root user actions

• Information about scheduled tasks

Answer explanation

/var/log/auth.log stores security-related events such as logins, root user actions, and output from PAM (Pluggable Authentication Modules).

How can you search for patterns in a log file using less?

• Press n for next match

• Press q to quit

• Press / to initiate search

• All of them

Answer explanation

All of the above. You can use / to initiate a search, n for the next match, and q to quit less.

In which log file would you investigate problems with the Linux operating system kernel?

• /var/log/syslog

• /var/kern/kern.log

• /var/log/kern.log

• /var/log/cron

Answer explanation

/var/log/kern.log stores kernel events, errors, and warning logs, which are helpful for troubleshooting problems with the operating system kernel.

What is a common method to investigate events in a syslog?

• Search for specific timestamps

• Narrow down search criteria

• Use grep with a specific pattern

• All of them

Answer explanation

When investigating syslog events, it's common to search for specific timestamps, narrow down search criteria, and use tools like grep for pattern matching.

To view events in a log file with less, what privileges are needed?

• Read-only privileges

• Root privileges

• Write privileges

• Execute privileges

Answer explanation

The main system logs are created with read-write permissions for the 'root' user only, so root privileges are needed to read them.

What log file would you inspect to identify unsuccessful SSH login attempts?

• /var/log/syslog

• /var/log/auth.log

• /var/log/kern.log

• /var/log/cron

Answer explanation

/var/log/auth.log is the log file where unsuccessful SSH login attempts are typically recorded.

From which remote IP is someone trying to brute-force SSH logins?

• 192.168.1.1

• 108.197.240.65

• 103.48.153.81

• 10.0.0.1

Answer explanation

The IP address for brute-force attempts is found in the log entry mentioning "invalid user" and includes the IP 108.197.240.65.

In which log file can you find information about Nginx client requests?

• /var/log/apache2/access.log

• /var/log/nginx/access.log

• /var/log/nginx/error.log

• /var/log/auth.log

Answer explanation

/var/log/nginx/access.log contains information about Nginx client requests.

How can you connect to a server using SSH with the specified hostname and username?

• ssh <username>@<hostname>

• ssh <hostname>@<username>

• connect <username>@<hostname>

• open <username>@<hostname>

Answer explanation

The correct syntax to connect to a server using SSH is ssh <username>@<hostname>.