Module 11 Quiz - Monitoring and Logs

Instructions

This quiz contains 30 multiple-choice questions to validate your understanding of Module 11.

Tip: Answer each question before revealing the answer. The answers are hidden just after each question.

---

Question 1

Which command allows you to see real-time CPU and memory usage?

1. ps

2. top or htop

3. monitor

4. stats

See explanation

Correct answer: top or htop

Explanation: top displays real-time CPU and memory usage with processes. htop is an improved and more user-friendly version. free shows memory, vmstat shows system statistics.

---

Question 2

Which command allows you to see memory usage?

1. memory

2. free

3. meminfo

4. memstat

See explanation

Correct answer: free

Explanation: free displays memory usage (RAM and swap). free -h displays in human-readable format (GB, MB). free -m in megabytes. cat /proc/meminfo shows complete details.

---

Question 3

Which command allows you to see disk space usage?

1. disk

2. df

3. diskfree

4. space

See explanation

Correct answer: df

Explanation: df displays disk space usage for all file systems. df -h displays in human-readable format (GB, MB). du shows usage of a specific directory. df -i shows inodes.

---

Question 4

Which command allows you to see the size of a directory?

1. size

2. du

3. dirsize

4. directory

See explanation

Correct answer: du

Explanation: du displays the size of a directory. du -h in human-readable format. du -sh /path shows the total size of a directory. du -h --max-depth=1 shows level 1 subdirectories.

---

Question 5

Which command allows you to see system logs on Ubuntu 24.04?

1. log

2. journalctl

3. syslog

4. logs

See explanation

Correct answer: journalctl

Explanation: journalctl displays system logs via systemd. journalctl -f follows in real-time. journalctl -u service displays logs of a service. journalctl --since today filters by date.

---

Question 6

Which command allows you to see logs in real-time?

1. journalctl

2. journalctl -f

3. journalctl --follow

4. tail -f /var/log/syslog

See explanation

Correct answer: journalctl -f

Explanation: journalctl -f follows logs in real-time (like tail -f). journalctl -u service -f follows logs of a specific service. Ctrl+C to stop. tail -f /var/log/syslog also works for old logs.

---

Question 7

Which directory contains traditional system logs?

1. /var/syslog

2. /var/log

3. /etc/log

4. /log

See explanation

Correct answer: /var/log

Explanation: /var/log contains traditional system logs. Common files: syslog, auth.log, kern.log, messages. On Ubuntu 24.04, many logs are also in journalctl, but /var/log is still used.

---

Question 8

Which command allows you to configure log rotation?

1. logrotate

2. logrotate (configuration in /etc/logrotate.d/)

3. rotate

4. logconfig

See explanation

Correct answer: logrotate (configuration in /etc/logrotate.d/)

Explanation: logrotate manages log rotation. Configuration in /etc/logrotate.conf and /etc/logrotate.d/*. logrotate -d file tests the configuration. logrotate -f file forces rotation.

---

Question 9

Which command allows you to see system statistics (CPU, memory, I/O)?

1. stats

2. vmstat or sar

3. systemstats

4. sysstat

See explanation

Correct answer: vmstat or sar

Explanation: vmstat displays system statistics (CPU, memory, swap, I/O). vmstat 2 every 2 seconds. sar (sysstat) collects and displays historical statistics. iostat shows disk I/O statistics.

---

Question 10

Which command allows you to see disk I/O statistics?

1. diskio

2. iostat

3. diskstat

4. iostats

See explanation

Correct answer: iostat

Explanation: iostat displays disk I/O statistics (reads/writes, throughput, wait time). iostat -x shows more details. iostat 2 every 2 seconds. Requires sysstat installed: sudo apt install sysstat.

---

Question 11

Which command allows you to see logs of a specific service?

1. journalctl service

2. journalctl -u service

3. journalctl --service service

4. service logs

See explanation

Correct answer: journalctl -u service

Explanation: journalctl -u service displays logs of a specific systemd service. journalctl -u service -f follows in real-time. journalctl -u service --since today filters by date. Very useful for diagnosing service issues.

---

Question 12

Which command allows you to see logs from today?

1. journalctl --today

2. journalctl --since today

3. journalctl today

4. journalctl -d today

See explanation

Correct answer: journalctl --since today

Explanation: journalctl --since today displays logs since midnight today. Other options: --since yesterday, --since "2024-12-01", --since "1 hour ago". --until filters until a date. Very flexible for time filtering.

---

Question 13

Which command allows you to see logs since the last boot?

1. journalctl --boot

2. journalctl -b

3. journalctl --since-boot

4. journalctl boot

See explanation

Correct answer: journalctl -b

Explanation: journalctl -b displays logs since the last boot. journalctl -b -1 shows logs from the previous boot. journalctl --list-boots lists all available boots with their IDs.

---

Question 14

Which command allows you to see cron job logs?

1. cronlog

2. journalctl -u cron or grep CRON /var/log/syslog

3. /var/log/cron

4. cron logs

See explanation

Correct answer: journalctl -u cron or grep CRON /var/log/syslog

Explanation: journalctl -u cron displays logs of the cron service. grep CRON /var/log/syslog searches for cron entries in system logs. Logs show executions and errors of cron jobs. Important for monitoring crons.

---

Question 15

Which command allows you to see processes using the most CPU?

1. ps cpu

2. ps aux --sort=-%cpu | head or top

3. cpuproc

4. topcpu

See explanation

Correct answer: ps aux --sort=-%cpu | head or top

Explanation: ps aux --sort=-%cpu | head -10 displays the top 10 processes using the most CPU. In top, press P to sort by CPU. Useful for identifying CPU-intensive processes.

---

Question 16

Which command allows you to see processes using the most memory?

1. ps mem

2. ps aux --sort=-%mem | head or top

3. memproc

4. topmem

See explanation

Correct answer: ps aux --sort=-%mem | head or top

Explanation: ps aux --sort=-%mem | head -10 displays the top 10 processes using the most memory. In top, press M to sort by memory. Useful for identifying memory-intensive processes.

---

Question 17

Which command allows you to see system load?

1. load

2. uptime or w

3. systemload

4. loadavg

See explanation

Correct answer: uptime or w

Explanation: uptime displays system load (load average) over 1, 5, and 15 minutes. w also displays load with connected users. cat /proc/loadavg also shows load. Load should be < number of CPUs.

---

Question 18

Which command allows you to see network statistics?

1. netstat

2. netstat -s or ss -s

3. networkstats

4. netinfo

See explanation

Correct answer: netstat -s or ss -s

Explanation: netstat -s or ss -s displays network statistics (packets sent/received, errors, etc.). ip -s link shows statistics by interface. Useful for diagnosing network issues.

---

Question 19

Which command allows you to see system error logs?

1. errorlog

2. journalctl -p err or grep -i error /var/log/syslog

3. errors

4. showerrors

See explanation

Correct answer: journalctl -p err or grep -i error /var/log/syslog

Explanation: journalctl -p err displays logs of error level and above. Levels: emerg, alert, crit, err, warning, notice, info, debug. grep -i error /var/log/syslog also searches for errors.

---

Question 20

Which command allows you to see logs of a specific user?

1. journalctl user

2. journalctl _UID=1000

3. journalctl --user username

4. userlog

See explanation

Correct answer: journalctl _UID=1000

Explanation: journalctl _UID=1000 displays logs for the user with UID 1000. journalctl _UID=$(id -u) for the current user. Useful for viewing logs of a specific user.

---

Question 21

Which command allows you to see logs with a limited number of lines?

1. journalctl --limit

2. journalctl -n 50

3. journalctl --lines 50

4. journalctl --head 50

See explanation

Correct answer: journalctl -n 50

Explanation: journalctl -n 50 displays the last 50 lines. journalctl -n 50 -f follows the last 50 lines then continues in real-time. Equivalent to tail -n 50 for files.

---

Question 22

Which command allows you to see historical system statistics with sar?

1. sar show

2. sar or sar -f /var/log/sa/saXX

3. sar list

4. sar history

See explanation

Correct answer: sar or sar -f /var/log/sa/saXX

Explanation: sar displays system statistics collected by sadc. sar -f /var/log/sa/sa01 reads a specific file. sar -u shows CPU, sar -r shows memory, sar -d shows disk. Requires sysstat installed and configured.

---

Question 23

Which command allows you to see logs with colors for easier reading?

1. journalctl --color

2. journalctl (colors by default if terminal supports)

3. journalctl -c

4. journalctl colored

See explanation

Correct answer: journalctl (colors by default if terminal supports)

Explanation: journalctl displays logs with colors by default if the terminal supports them. Log levels have different colors (error in red, etc.). journalctl --no-pager avoids the pager for scripts.

---

Question 24

Which command allows you to see logs of a specific executable?

1. journalctl --executable

2. journalctl _COMM=executable-name

3. journalctl -e executable-name

4. journalctl exec executable-name

See explanation

Correct answer: journalctl _COMM=executable-name

Explanation: journalctl _COMM=firefox displays logs for the firefox executable. _COMM filters by command name. Other filters: _PID, _UID, _SYSTEMD_UNIT. Useful for viewing logs of a specific program.

---

Question 25

Which command allows you to see logs between two dates?

1. journalctl --between

2. journalctl --since "date1" --until "date2"

3. journalctl --range date1 date2

4. journalctl date1 date2

See explanation

Correct answer: journalctl --since "date1" --until "date2"

Explanation: journalctl --since "2024-12-01 10:00:00" --until "2024-12-01 12:00:00" displays logs between two dates. Flexible formats: "yesterday", "1 hour ago", "2024-12-01", etc. Very useful for analyzing a specific period.

---

Question 26

Which command allows you to see logs in JSON format?

1. journalctl --json

2. journalctl -o json

3. journalctl --format json

4. journalctl json

See explanation

Correct answer: journalctl -o json

Explanation: journalctl -o json displays logs in JSON format. Other formats: -o short, -o verbose, -o export. Useful for processing by scripts or external tools. jq can parse JSON.

---

Question 27

Which command allows you to see logs in a more verbose format?

1. journalctl --verbose

2. journalctl -o verbose

3. journalctl -v

4. journalctl verbose

See explanation

Correct answer: journalctl -o verbose

Explanation: journalctl -o verbose displays logs with all available fields (PID, UID, command, etc.). -o short is the default format (more compact). -o export for export/import.

---

Question 28

Which command allows you to see logs with a filter by minimum priority?

1. journalctl --priority

2. journalctl -p err

3. journalctl --level err

4. journalctl priority err

See explanation

Correct answer: journalctl -p err

Explanation: journalctl -p err displays logs of error level and above (err, crit, alert, emerg). Levels: emerg, alert, crit, err, warning, notice, info, debug. Useful for filtering important errors.

---

Question 29

Which command allows you to see logs with a filter by message (grep)?

1. journalctl --grep

2. journalctl | grep term or journalctl -g term

3. journalctl --search term

4. journalctl search term

See explanation

Correct answer: journalctl | grep term or journalctl -g term

Explanation: journalctl | grep error filters logs containing "error". journalctl -g "error" also works (more efficient). Useful for searching specific messages in logs. Combine with other filters.

---

Question 30

Which command allows you to see logs in an exportable format (for saving)?

1. journalctl --export

2. journalctl -o export

3. journalctl --save

4. journalctl export

See explanation

Correct answer: journalctl -o export

Explanation: journalctl -o export > logs.txt exports logs in an importable format. journalctl -o export | journalctl --input -o short imports later. Useful for saving or transferring logs to another system.

---

Quiz Result

Congratulations on completing the Module 11 quiz!

Score:

• 25-30 correct answers: Excellent! You master Linux monitoring and logs.
• 20-24 correct answers: Very good! Review the concepts where you had difficulties.
• 15-19 correct answers: Good! Review the chapters on monitoring and logs.
• Less than 15: Recommended to review the module before continuing.

---

Next Steps

Now that you have validated your knowledge:

Module 12: Advanced Administration
Practical Labs: Practice monitoring and logs with Module 11 labs

---

Quiz created on: December 2024 - Tested on Ubuntu 24.04