A line in /etc/rsyslog.conf reads `*.info;mail.none;authpriv.none;cron.none /var/log/messages`. What does the `mail.none` component do?
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct It keeps messages from the mail facility out of /var/log/messages, at every priority.
Correct. The keyword none in the priority position means that no message of that facility is selected by this rule, so the earlier *.info no longer applies to mail.
Not correct It writes mail messages of priority none, the level below debug, to the file.
Wrong. There is no severity called none; the eight levels run from debug up to emerg. none is a selector keyword, not a priority.
Not correct It discards mail messages system-wide, as if they had been sent to /dev/null.
Wrong. A selector governs only the rule it appears in. Mail messages are still delivered by any other rule that selects them, which is normally the one writing /var/log/mail.log.
Not correct It matches only mail messages that arrive without a priority field.
Wrong. Every syslog message carries a facility and a severity encoded in its PRI value; a message without one does not exist on the wire.
Why
A selector is a semicolon-separated list of facility.priority pairs evaluated left to right, and each later pair refines what the earlier ones matched. The idiom here is to gather info-and-above from everything, then subtract the facilities that already have dedicated files. Remember the three modifiers that change the default and-above sense: none selects nothing, = selects exactly that severity, and ! negates.
Where this comes from
- Cited
- manual page rsyslog.conf(5)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked