Which of the following are valid standard syslog facility names usable on the left-hand side of an rsyslog selector? (Choose three.)
LPIC-1 Exam 102-500, objective 108. Essential system services medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 3.
Not correct process
Not a facility. There is no `process` facility; messages from ordinary programs default to the user facility.
Correct authpriv
Valid. authpriv carries security and authorisation messages that should not be world-readable, which is why they land in /var/log/secure on RHEL-family systems and /var/log/auth.log on Debian-family ones.
Not correct network
Not a facility. Networking messages come from the kernel (kern) or from the daemon in question (daemon), and there is no `network` facility in the syslog protocol.
Correct local5
Valid. local0 through local7 are deliberately left undefined by the standard so administrators and appliances can assign them to their own applications.
Correct cron
Valid. cron is the facility used by the scheduling daemons for job start, finish and failure messages.
Why
The syslog protocol fixes the facility list: auth, authpriv, cron, daemon, ftp, kern, lpr, mail, news, security (a deprecated synonym for auth), syslog, user, uucp and local0-local7. Anything outside that list cannot appear in a selector. The facility is chosen by the sending program, not by rsyslog, which is why `logger -p local3.info` exists — it lets a shell script pick a facility deliberately.
Where this comes from
- Cited
- LPI exam objective 108.2
- What it says
- Standard syslog facilities and their meaning.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked