A server no longer boots. You have started a rescue system from removable media and mounted the broken machine's root filesystem at /mnt. Which command reads that machine's persistent journal?
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct journalctl -D /mnt/var/log/journal
Correct. -D (--directory) points journalctl at a journal directory anywhere in the filesystem instead of the local machine's own, which is exactly the rescue case.
Not correct journalctl -m
Wrong. -m (--merge) interleaves all journals of the running machine, persistent and volatile, including those of other users. It never looks at a mounted foreign root.
Not correct journalctl -M /mnt
Wrong. -M (--machine) reads the journal of a running local container registered with systemd-machined, and takes a machine name, not a path.
Not correct journalctl /mnt/var/log/journal
Wrong. A bare path argument to journalctl is a match, not a source selector: it is read as the executable or device node the entries must have come from, so it queries the rescue system's own journal and finds nothing (a directory is neither, so journalctl rejects it outright). Reading journal files elsewhere in the filesystem needs -D/--directory, --file or --root.
Why
Journal files are self-contained binary files, so they can be read on any machine with a compatible journalctl: --directory takes a journal directory, --file takes individual .journal files and accepts globs, and --root takes a whole root tree and finds the journal beneath it. This only works if the failed host had persistent storage enabled; with the default volatile journal in /run there is nothing on disk to read. Adding --no-pager or -o short-iso is usual when transcribing the output.
Where this comes from
- Cited
- manual page journalctl(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked