In an rsyslog rule the action is written as `-/var/log/debug` rather than `/var/log/debug`. What is the effect of the leading hyphen?
LPIC-1 Exam 102-500, objective 108. Essential system services medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct rsyslog does not flush the file to disk after each individual message.
Correct. The hyphen suppresses the sync after every write, which matters for high-volume files because each sync is a separate disk operation.
Not correct The file is created if it does not already exist.
Wrong. rsyslog creates missing output files regardless, with the ownership and mode given by the FileOwner, FileGroup and FileCreateMode settings.
Not correct Messages are appended instead of replacing the file's contents.
Wrong. Log actions always append; nothing in the syntax ever asks for truncation. Emptying a log file is logrotate's job.
Not correct Consecutive identical messages are collapsed into a single line.
Wrong. That is repeated-message reduction, controlled by the RepeatedMsgReduction setting, and it produces the familiar last message repeated N times line.
Why
The hyphen trades durability for throughput: after a crash the tail of an unsynced file may be missing, so it is used on chatty debug logs and avoided on the security-relevant ones. It is a compatibility spelling inherited from sysklogd and applies only to file actions, not to remote forwarding with @ or @@. A rule's action begins after the whitespace that follows the selector, so the hyphen is part of the action, never of the selector.
Where this comes from
- Cited
- manual page rsyslog.conf(5)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked