Option B: journalctl -p err shows only error log level.
* Explanation:
* The -p or --priority option in journalctl filters messages by their priority level.
* When specifying asingle priority level, journalctl shows messagesonlyat that level.
* The priority levels, as per syslog standards, are:
* 0: emerg
* 1: alert
* 2: crit
* 3: err
* 4: warning
* 5: notice
* 6: info
* 7: debug
* Therefore, journalctl -p err displays messages with priorityerr (3)only.
* Oracle Linux Reference:
* OracleLinux 8: Managing Log Files- Section onFiltering Output withjournalctl:
"Use the -p option to display messages from the journal that have a specific priority level."
* Example:
# journalctl -p err
Option D: journalctl -k shows kernel logs since the last boot.
* Explanation:
* The -k or --dmesg option filters messages from the kernel, equivalent to the output of the dmesg command.
* This option implies -b, which limits the output to messages from the current boot.
* Therefore, journalctl -k displays kernel messages since the last boot.
* Oracle Linux Reference:
* OracleLinux 8: Managing Log Files- Section onViewing Kernel Messages:
"Use the journalctl -k command to display kernel messages since the last system boot."
* Example:
# journalctl -k
Option E: journalctl -p 6 shows all info log level messages and above.
* Explanation:
* When specifying a single numeric priority, journalctl displays messages withthat priority level and higher priority levels(i.e., lower severity).
* Priority levels are ordered from 0 (highest severity) to 7 (lowest severity).
* Therefore, journalctl -p 6 shows messages with priorities:
* 0 (emerg)
* 1 (alert)
* 2 (crit)
* 3 (err)
* 4 (warning)
* 5 (notice)
* 6 (info)
* This includesinfo level messages (6)and all higher priority messages.
* Oracle Linux Reference:
* OracleLinux 8: Managing Log Files- Section onFiltering Output with journalctl:
"When you specify a single priority level, journalctl shows messages at that level and higher severity."
* Example:
# journalctl -p 6
Why Other Options Are Not Correct:
* Option A:journalctl -bl -p err fails if journal persistence is not configured.
* Explanation:
* The -b option displays messages from the current boot. This works even if journal persistence isnotconfigured because the logs from the current boot are stored in volatile memory (/run/log/journal).
* Therefore, the command doesnot failif journal persistence is not configured.
* Oracle Linux Reference:
* OracleLinux 8: Managing Log Files- Section onJournal Volatility:
"By default, the journal stores logs in volatile memory and does not persist logs across reboots unless persistent storage is configured."
* Option C:journalctl -p notice..warning shows all messages from notice to warning log level since the last boot.
* Explanation:
* The -p option allows specifying arangeof priorities. However, the correct order for the range should be from thehigher priority (lower number)to thelower priority (higher number).
* Also, the priorities should be specified in the correct sequence, and ranges are inclusive.
* Moreover, journalctl by default shows messages from all boots unless limited by the -b option.
* Therefore, without -b, it does not limit messages to "since the last boot," making the statement incorrect.
* Correct Command:
* To display messages fromwarning (4)tonotice (5), the command should be:
# journalctl -p warning..notice -b
* But even then, the priorities need to be specified correctly, and the command in Option C is incorrect.
Conclusion:
OptionsB,D, andEare correct because they accurately describe the behavior of the journalctl command in filtering and displaying log messages based on priority levels and sources.