LPIC-1 Devices, Filesystems and FHS Practice Question
Exhibit
Refer to the exhibit. $ df -h /var/log Filesystem Size Used Avail Use% Mounted on /dev/sda3 20G 18G 1.5G 93% /var/log $ ls -la /var/log/syslog -rw-r----- 1 syslog adm 2048000000 Feb 20 10:30 /var/log/syslog
Refer to the exhibit. The system administrator sees that /var/log is 93% full and the syslog file is nearly 2 GB. What is the most appropriate immediate action to free up disk space without losing any critical log data?
⚠ Common exam trap
LPI often tests the misconception that deleting or moving log files is acceptable, when in fact the correct immediate action is to use logrotate -f to safely rotate logs without data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'logrotate -f /etc/logrotate.conf' to force log rotation.
'logrotate -f' forces an immediate rotation of all log files as defined in /etc/logrotate.conf, which compresses or archives the current syslog file (e.g., syslog becomes syslog.1) and creates a fresh empty log file. This frees disk space without deleting any data, as the rotated logs remain on disk until the configured retention policy removes them. It is the standard, safe immediate action for a nearly full /var/log partition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'logrotate -f /etc/logrotate.conf' to force log rotation.
Why this is correct
logrotate will compress and rotate the file, freeing space while keeping old logs.
- ✗
Increase the size of the /var/log partition using lvextend.
Why it's wrong here
This requires additional disk space and is not immediate; also it doesn't address the large file.
- ✗
Delete /var/log/syslog and restart the syslog daemon.
Why it's wrong here
Deleting the file loses log data; also the syslog daemon may hold file handle, causing issues.
- ✗
Move /var/log/syslog to /tmp and create a symbolic link.
Why it's wrong here
Moving doesn't free space on /var/log; /tmp may also fill up.
Go deeper
Related to this question
About these practice questions
One of 527 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.