A systemd server with a persistent journal rebooted overnight. You need the log messages from the boot that ended in that reboot, not from the current boot. Which command shows them?
LPIC-1 Exam 101-500, objective 101. System architecture medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Not correct dmesg
Wrong. dmesg prints the kernel ring buffer, which lives in memory and is emptied at every boot, so it can never show anything from a previous boot.
Not correct journalctl -b
Wrong. With no offset, -b limits output to the current boot, which is precisely the boot you want to exclude.
Correct journalctl -b -1
Correct. -b takes a boot offset: 0 (the default) is the current boot, -1 the previous one, -2 the one before that. journalctl --list-boots shows the offsets available.
Not correct journalctl -f
Wrong. -f follows the journal and prints new entries as they arrive, like tail -f. It shows the present, not the past.
Why
Boot-offset selection only works if the journal survives reboots. That requires persistent storage, normally Storage=persistent in /etc/systemd/journald.conf or simply the existence of /var/log/journal; with the default volatile setup the journal lives in /run/log/journal and is lost at reboot. For kernel-only messages add -k, which is the journal equivalent of dmesg but can be combined with a boot offset.
Where this comes from
- Cited
- LPI exam objective 101.2
- What it says
- Reviewing boot messages with dmesg and with the systemd journal.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 101 and space the ones you get wrong.
More questions on this objective
- You have a module file for a network driver on disk but the driver is not loaded. Which command reports the module's description, license, its dependencies and the parameters it accepts, without loading it into the kernel? machine-checked
- A module was loaded together with several modules it depends on. Which command unloads that module and then also unloads the dependencies that are left with a use count of zero? machine-checked
- You are filing a hardware bug report and the maintainer asks for the raw PCI vendor and device ID numbers rather than the human-readable names lspci normally prints. Which lspci option produces the numeric IDs? machine-checked
- A USB device is not getting the device node you expect. You want to watch, live, the kernel uevents and the resulting udev events as you unplug and replug it. Which command does that? machine-checked
- On a traditional BIOS PC, the firmware has completed its power-on self test and selected the hard disk as the boot device. What happens next? machine-checked
- A systemd-based machine fails during a normal boot because a service hangs. At the boot loader menu you want to edit the kernel command line for this one boot so the system comes up in single-user rescue mode instead. Which parameter do you append? machine-checked