mediumMultiple ChoiceObjective-mapped
XK0-006 systemd journal Practice Question
A developer runs a web application inside a Podman container. The application logs HTTP requests to stdout in JSON format. The operations team wants to centralize these logs by forwarding them to a remote syslog server. The administrator considers several approaches. Which approach is the most reliable and recommended way to forward container logs to syslog without modifying the application?
⚠ Common exam trap
A common misconception is that mounting a volume and having the application write logs to a file is a non-invasive approach, but it actually requires modifying the application's logging behavior. The recommended approach that does not modify the application is to use the systemd journal and its forwarding capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `journalctl -u container-name` to export logs via a syslog forwarder.
Using journalctl to export logs via a syslog forwarder is the most reliable and recommended approach because it leverages the container runtime's logging mechanism without modifying the application. By default, Podman sends container logs to the systemd journal, which can be configured to forward logs to a remote syslog server using journald's built-in forwarding capabilities (e.g., setting ForwardToSyslog=yes in /etc/systemd/journald.conf). This method is persistent, reliable, and does not require changes to the application or its configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a cron job to run `podman logs -f` and pipe the output to `logger`.
Why it's wrong here
Incorrect because using a cron job with `podman logs -f` is unreliable; it relies on continuous execution and may miss logs if the container restarts or if the cron job fails.
- ✓
Use `journalctl -u container-name` to export logs via a syslog forwarder.
Why this is correct
Correct as described.
- ✗
Use `podman exec` to run a log shipper inside the container.
Why it's wrong here
Incorrect because using `podman exec` to run a log shipper inside the container adds complexity and resource overhead, and may not survive container restarts if not properly managed.
- ✗
Configure the application to write logs to a file in a mounted volume, and have the host's syslog daemon tail that file.
Why it's wrong here
Incorrect because it requires modifying the application's logging configuration to write to a file instead of stdout, which contradicts the requirement of not modifying the application.
Go deeper
Related to this question
Learn chapter
Networking Fundamentals and Configuration
Key term
Syslog
Syslog is a standard protocol used to send and store log messages from network devices and servers to a central logging server for monitoring and troubleshooting.
Key term
journald
journald is the systemd logging service that collects, stores, and manages system logs on modern Linux distributions, providing structured log data and binary log files.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.