linuxexpert-practice-labs/labs/lpic-1/108-2-system-logging/README.md

LPIC-1 108.2: System logging

logger and the journal, an rsyslog rule, a persistent journal, and a logrotate rule.

Before you start

The lab makes the journal non-persistent: if /var/log/journal exists, it moves it to /var/log/journal.le-lab (reset puts it back), so the journal lives in /run and is lost at every reboot. Task 3 needs a reboot; do task 1 again afterwards if its message was lost with it.

Tasks

1. Send a message with logger -t test -p user.warning and find it with journalctl -t test and, if rsyslog is installed, in /var/log.
2. Install rsyslog if needed, add a rule sending local3.* to /var/log/local3.log, restart it, and test with logger -p local3.info.
3. Check whether the journal is persistent with ls /var/log/journal. Make it persistent, reboot, and read the previous boot with journalctl -b -1.
4. As root, write a logrotate rule /etc/logrotate.d/lrtest for /var/log/lrtest/test.log, fill the log, and run logrotate -d and then logrotate -f on the rule, so that the log is rotated.

Hints

• journalctl -t test -p warning; grep test /var/log/syslog or /var/log/messages.
• A file in /etc/rsyslog.d/ ending in .conf; rsyslogd -N1 checks the configuration.
• Storage=persistent in /etc/systemd/journald.conf (or a drop-in), or create /var/log/journal; journalctl --list-boots.
• mkdir /var/log/lrtest; a block with rotate, size or daily, compress, missingok; logrotate -d /etc/logrotate.d/lrtest.