On a distribution that runs both systemd-journald and rsyslog, which two statements are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Not correct Installing rsyslog automatically disables systemd-journald, since two loggers cannot run at once.
Incorrect. journald is a core systemd component and keeps running. The two coexist routinely, which is exactly why an administrator must know both query tools.
Correct rsyslog can obtain messages from the journal and write them into the familiar plain-text files under /var/log.
Correct. rsyslog's imjournal input module reads journald's database (and imuxsock reads the /dev/log socket), so files such as /var/log/messages or /var/log/syslog keep being produced.
Not correct The journal is stored as plain text, so grep on /var/log/journal works the same way as on /var/log/messages.
Incorrect. The journal is a structured, indexed binary format. It must be read through journalctl or the journal API; grep on the raw files is not a supported way to search it.
Correct Messages submitted with logger can end up in both the journal and an rsyslog-written text file.
Correct. A single message can be recorded by journald and also forwarded to rsyslog, so the same event legitimately appears in journalctl output and in a /var/log file.
Not correct journalctl reads /etc/rsyslog.conf to decide which messages to show.
Incorrect. journalctl queries journald's own store and is configured by /etc/systemd/journald.conf. rsyslog.conf only governs rsyslog's own routing.
Why
On most mainstream distributions journald receives everything first and rsyslog then consumes from it, producing the traditional text files. That means two parallel views of the same events: journalctl for structured, indexed queries with metadata such as unit and boot id, and grep, tail and awk over /var/log for the text copies. Neither replaces the other, and knowing which tool to reach for is what the objective is testing.
Where this comes from
- Cited
- LPI exam objective 108.2
- What it says
- Understand the interaction of systemd-journald with rsyslog on the same system.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked