LPIC-1 Shells, Scripting and Data Management Practice Question
A system administrator wants to monitor a log file in real-time for lines containing 'ERROR' and write them to a separate file. Which command combination is most appropriate?
⚠ Common exam trap
Candidates often confuse `cat` with `tail -f`, thinking both can monitor a file in real time, but `cat` only dumps the current content and exits, while `tail -f` actively follows appended data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tail -f logfile | grep 'ERROR' > error.log
`tail -f logfile` continuously outputs new lines appended to the file, and piping that output into `grep 'ERROR'` filters only lines containing 'ERROR', which are then redirected to `error.log`. This combination achieves real-time monitoring and selective logging without blocking the terminal or requiring manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
less logfile
Why it's wrong here
less opens the file for interactive paging and stops at the end; it neither follows appended lines nor filters for 'ERROR' nor writes output. It is tempting because it displays log content, but real-time monitoring with filtering and redirection requires tail -f piped to grep, redirecting matches to the separate file.
- ✓
tail -f logfile | grep 'ERROR' > error.log
Why this is correct
`tail -f` follows the file as new lines are appended, satisfying the real-time monitoring constraint, while the pipe feeds each line to `grep 'ERROR'` for filtering. The redirection then writes only matching lines to error.log. Unlike `cat`, which exits at EOF, `tail -f` persists, so continuous logging is captured.
- ✗
vi logfile
Why it's wrong here
vi is an editor, not for real-time monitoring.
- ✗
cat logfile | grep 'ERROR' > error.log
Why it's wrong here
cat reads the file once and exits, so grep receives a finite stream and stops; no new lines are captured as the log grows. It is tempting because the pipeline syntax is correct for filtering, and it would work for a one-off snapshot rather than live monitoring.
Go deeper
Related to this question
About these practice questions
One of 402 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.