CompTIA Linux+ (XK0-006)System ManagementMedium
A server administrator suspects a service failure occurred during the most recent boot and wants to view only journal entries with a priority of 'err' or higher from that boot. Which command should be used?
- Ajournalctl -b -p err
- Bjournalctl -f
- Cjournalctl --since today
- Djournalctl -k
Show answer & explanationAnswer & explanation
Correct answer: A. journalctl -b -p err
-b limits output to the current boot and -p err filters entries at priority 'err' and above. -k only shows kernel messages, --since today doesn't filter by priority, and -f follows the live log without filtering by boot or priority.
Why the other options are wrong
- B. Follows the live log; does not filter by boot or priority.
- C. Filters by time only; does not filter by severity.
- D. Restricts to kernel ring buffer messages only, not all services.
journalctl Filtering
journalctl supports flags to filter by boot session (-b) and priority level (-p) to narrow down relevant log entries.
- -b [N] filters by boot number
- -p priority filters by severity (emerg..debug)
- -k shows only kernel ring buffer messages
- -f follows the log in real time
Memory trick: Boot + Priority = pinpoint the problem period and severity