A server crashed and has since rebooted. You want the journal entries of severity error and above from the boot before the current one. Which command retrieves them?
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct journalctl -f -p err
Wrong. -f follows the journal from the present moment forward, so it shows entries that have not happened yet, not the previous boot.
Not correct journalctl --since err -b
Wrong on both counts. --since takes a time, not a severity, and -b without an offset selects the current boot rather than the previous one.
Correct journalctl -b -1 -p err
Correct. -b -1 selects the boot immediately before the current one, and -p err limits output to severity err and the more urgent levels crit, alert and emerg.
Not correct journalctl -u -1 -p 3
Wrong. -u expects a unit name, so it would consume -1 as the unit. The -p 3 part is fine on its own, since 3 is the numeric form of err.
Why
-b with no argument means the current boot; -b -1 the previous one, -b -2 the one before that, and `journalctl --list-boots` prints the identifiers of the boots the journal still holds. This only works if the journal is persistent — a volatile journal in /run/log/journal is lost at every reboot, so the previous boot simply is not there. -p accepts either the syslog level name or its number (0 emerg through 7 debug) and always means 'this level and more urgent'.
Where this comes from
- Cited
- LPI exam objective 108.2
- What it says
- Filter journal output by boot and by priority.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 108 and space the ones you get wrong.