LPIC-2 System Security Practice Question
A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?
⚠ Common exam trap
Many exam-takers confuse `auth` with `authpriv` — candidates often pick `auth.*` thinking it covers all authentication, but `authpriv` is the correct facility for privileged command logging and is a key distinction tested in LPIC-2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
authpriv.* @192.168.1.100
The `authpriv` facility in rsyslog is specifically designated for security and authorization messages, including all commands executed by root via `sudo` or direct login. The directive `authpriv.* @192.168.1.100` sends all messages from this facility to the remote syslog server at UDP port 514. This matches the requirement to log root's commands, as Linux systems typically log such events under the `authpriv` facility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
auth.* @192.168.1.100
Why it's wrong here
auth is for general authentication, but authpriv is more specific.
- ✓
authpriv.* @192.168.1.100
Why this is correct
authpriv facility logs security/authorization messages including sudo commands.
- ✗
user.* @192.168.1.100
Why it's wrong here
user facility is for user-level messages.
- ✗
kern.* @192.168.1.100
Why it's wrong here
kern is kernel facility, not for root commands.
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.