LPIC-1 Administrative Tasks Practice Question
A system is not logging messages to /var/log/syslog. Which command should an administrator use first to diagnose the issue?
⚠ Common exam trap
The trap here is that candidates often jump to testing the logging pipeline (with 'logger') or checking for a process by name, instead of first verifying the service status with systemctl, which is the systematic and most efficient diagnostic step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
systemctl status rsyslog
The first step in diagnosing why messages are not appearing in /var/log/syslog is to verify that the rsyslog service is running and active. The 'systemctl status rsyslog' command shows the current service state, recent logs, and any errors that might prevent logging. Without confirming the service status, other diagnostic steps may be misleading.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tail -f /var/log/syslog
Why it's wrong here
tail -f displays appended lines in real time, so on a file receiving nothing it simply hangs without revealing the cause. It is tempting because it directly observes the target file, but it cannot show why the daemon stopped writing; the first step is examining the syslog daemon's configuration and status.
- ✗
logger test
Why it's wrong here
logger writes a test message to syslog, so it only confirms whether the daemon accepts input, not why existing messages are missing. It is tempting as a quick end-to-end check, but the first diagnostic step is inspecting the daemon's configuration and status, not injecting new entries.
- ✗
ps aux | grep syslog
Why it's wrong here
Listing processes confirms whether the syslog daemon is running, but a running process does not reveal why it is not writing to /var/log/syslog. It is tempting because a stopped daemon is a common cause, yet configuration, socket and permission faults remain invisible; checking the daemon's own configuration and logs is the correct first step.
- ✓
systemctl status rsyslog
Why this is correct
systemctl status rsyslog reveals whether the rsyslog unit is active, failed or masked, and shows recent journal output explaining why messages stopped reaching /var/log/syslog. This checks the daemon responsible for writing that file before investigating configuration or permissions.
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 402-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.