On a distribution that runs both systemd-journald and rsyslog, which two statements are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Choose 2.
Not correct Installing rsyslog automatically disables systemd-journald, since two loggers cannot run at once.
Incorrect. journald is a core systemd component and keeps running. The two coexist routinely, which is exactly why an administrator must know both query tools.
Correct rsyslog can obtain messages from the journal and write them into the familiar plain-text files under /var/log.
Correct. rsyslog's imjournal input module reads journald's database (and imuxsock reads the /dev/log socket), so files such as /var/log/messages or /var/log/syslog keep being produced.
Not correct The journal is stored as plain text, so grep on /var/log/journal works the same way as on /var/log/messages.
Incorrect. The journal is a structured, indexed binary format. It must be read through journalctl or the journal API; grep on the raw files is not a supported way to search it.
Correct Messages submitted with logger can end up in both the journal and an rsyslog-written text file.
Correct. A single message can be recorded by journald and also forwarded to rsyslog, so the same event legitimately appears in journalctl output and in a /var/log file.
Not correct journalctl reads /etc/rsyslog.conf to decide which messages to show.
Incorrect. journalctl queries journald's own store and is configured by /etc/systemd/journald.conf. rsyslog.conf only governs rsyslog's own routing.
Why
On most mainstream distributions journald receives everything first and rsyslog then consumes from it, producing the traditional text files. That means two parallel views of the same events: journalctl for structured, indexed queries with metadata such as unit and boot id, and grep, tail and awk over /var/log for the text copies. Neither replaces the other, and knowing which tool to reach for is what the objective is testing.
Where this comes from
- Cited
- LPI exam objective 108.2
- What it says
- Understand the interaction of systemd-journald with rsyslog on the same system.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 108 and space the ones you get wrong.