LPIC-1 Administrative Tasks Practice Question
An administrator notices that /var/log/syslog is 3 GB in size, despite logrotate being configured to rotate logs weekly and keep 4 weeks. The logrotate configuration file /etc/logrotate.d/syslog contains: /var/log/syslog { weekly rotate 4 compress missingok notifempty } The administrator checks that logrotate is scheduled via cron and sees that the cron job exists. However, the administrator suspects that logrotate might not have been running. Which of the following commands should the administrator run first to force log rotation and diagnose the issue?
⚠ Common exam trap
LPI often tests the difference between `-d` (debug/dry-run) and `-f` (force) in logrotate, and the trap here is that candidates may choose debug mode thinking it will fix the issue, when only force actually triggers the rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
logrotate -f /etc/logrotate.d/syslog
The `-f` (force) flag tells logrotate to rotate the log file immediately, regardless of whether the configured time interval has elapsed. This allows the administrator to trigger a rotation on demand and observe any errors or misconfigurations that might explain why the file grew to 3 GB despite the weekly rotation policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
logrotate -d /etc/logrotate.d/syslog
Why it's wrong here
Debug mode shows what would happen but does not rotate.
- ✗
systemctl restart crond
Why it's wrong here
Restarting cron does not fix a logrotate issue.
- ✓
logrotate -f /etc/logrotate.d/syslog
Why this is correct
Forces rotation immediately, which tests the configuration.
- ✗
cat /var/lib/logrotate/status
Why it's wrong here
Shows last rotation times but does not force rotation.
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 527-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.