Red Hat System Administration II

Instructions

1. From the workstation machine, open an SSH session to the servera machine as the student user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$

2. Use the journalctl command _PID=1 option to display only log events that originate from the systemd PID 1 process on the servera machine. To quit from the journalctl command, press q. The following output is an example and might differ on your system:

   [student@servera ~]$ journalctl _PID=1
   Mar 15 04:21:14 localhost systemd[1]: Finished Load Kernel Modules.
   Mar 15 04:21:14 localhost systemd[1]: Finished Setup Virtual Console.
   Mar 15 04:21:14 localhost systemd[1]: dracut ask for additional cmdline parameters was skipped because all trigger condition checks failed.
   Mar 15 04:21:14 localhost systemd[1]: Starting dracut cmdline hook...
   Mar 15 04:21:14 localhost systemd[1]: Starting Apply Kernel Variables...
   lines 1-5 q
   [student@servera ~]$

3. Use the journalctl command _UID=81 option to display all log events that originated from a system service with a UID of 81 on the servera machine.

   [student@servera ~]$ journalctl _UID=81
   Mar 15 04:21:17 servera.lab.example.com dbus-broker-lau[727]: Ready

4. Use the journalctl command -p warning option to display log events with a warning or higher priority on the servera machine.

   [student@servera ~]$ journalctl -p warning
   Mar 15 04:21:14 localhost kernel: wait_for_initramfs() called before rootfs_initcalls
   Mar 15 04:21:14 localhost kernel: ACPI: PRMT not present
   Mar 15 04:21:14 localhost kernel: acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended PCI configuration space under this bridge.
   Mar 15 04:21:14 localhost kernel: device-mapper: core: CONFIG_IMA_DISABLE_HTABLE is disabled. Duplicate IMA measurements will not be recorded in the IMA log.
   ...output omitted...
   Mar 15 04:21:18 servera.lab.example.com NetworkManager[769]: <warn>  [1647332478.5504] device (eth0): mtu: failure to set IPv6 MTU
   Mar 15 04:21:27 servera.lab.example.com chronyd[751]: System clock wrong by -0.919695 seconds
   Mar 15 04:22:34 servera.lab.example.com chronyd[751]: System clock wrong by 0.772805 seconds
   Mar 15 05:41:11 servera.lab.example.com sshd[1104]: error: kex_exchange_identification: Connection closed by remote host
   lines 1-19/19 (END) q
   [student@servera ~]$

5. Display all recorded log events in the past 10 minutes from the current time on the servera machine.

   [student@servera ~]$ journalctl --since "-10min"
   Mar 15 05:40:01 servera.lab.example.com anacron[1092]: Job `cron.weekly' started
   Mar 15 05:40:01 servera.lab.example.com anacron[1092]: Job `cron.weekly' terminated
   Mar 15 05:41:11 servera.lab.example.com sshd[1104]: error: kex_exchange_identification: Connection closed by remote host
   Mar 15 05:41:11 servera.lab.example.com sshd[1104]: Connection closed by 172.25.250.9 port 45370
   Mar 15 05:41:14 servera.lab.example.com sshd[1105]: Accepted publickey for student from 172.25.250.9 port 45372 ssh2: RSA SHA256:M8ikhcEDm2tQ95Z0o7ZvufqEixCFCt+wowZLNzNlBT0
   Mar 15 05:41:14 servera.lab.example.com systemd[1]: Created slice User Slice of UID 1000.
   Mar 15 05:41:14 servera.lab.example.com systemd[1]: Starting User Runtime Directory /run/user/1000...
   Mar 15 05:41:14 servera.lab.example.com systemd-logind[739]: New session 1 of user student.
   Mar 15 05:41:14 servera.lab.example.com systemd[1]: Finished User Runtime Directory /run/user/1000.
   Mar 15 05:41:14 servera.lab.example.com systemd[1]: Starting User Manager for UID 1000...
   ...output omitted...
   Mar 15 05:44:56 servera.lab.example.com systemd[1109]: Stopped target Sockets.
   Mar 15 05:44:56 servera.lab.example.com systemd[1109]: Stopped target Timers.
   Mar 15 05:44:56 servera.lab.example.com systemd[1109]: Stopped Mark boot as successful after the user session has run 2 minutes.
   Mar 15 05:44:56 servera.lab.example.com systemd[1109]: Stopped Daily Cleanup of User's Temporary Directories.
   lines 1-48 q
   [student@servera ~]$

6. Use the journalctl command --since and _SYSTEMD_UNIT="sshd.service" options to display all the recorded log events that originated from the sshd service since 09:00:00 this morning on the servera machine.

   Note

   Online classrooms typically run on the UTC time zone. To obtain results that start at 9:00 AM in your local time zone, adjust your --since value by the amount of your offset from UTC. Alternatively, ignore the local time and use a value of 9:00 to locate journal entries that occurred since 9:00 for the servera time zone.

   [student@servera ~]$ journalctl --since 9:00:00 _SYSTEMD_UNIT="sshd.service"
   Mar 15 09:41:14 servera.lab.example.com sshd[1105]: Accepted publickey for student from 172.25.250.9 port 45372 ssh2: RSA SHA256:M8ikhcEDm2tQ95Z0o7ZvufqEixCFCt+wowZLNzNlBT0
   Mar 15 09:41:15 servera.lab.example.com sshd[1105]: pam_unix(sshd:session): session opened for user student(uid=1000) by (uid=0)
   Mar 15 09:44:56 servera.lab.example.com sshd[1156]: Accepted publickey for student from 172.25.250.9 port 45374 ssh2: RSA SHA256:M8ikhcEDm2tQ95Z0o7ZvufqEixCFCt+wowZLNzNlBT0
   Mar 15 09:44:56 servera.lab.example.com sshd[1156]: pam_unix(sshd:session): session opened for user student(uid=1000) by (uid=0)

7. Return to the workstation system as the student user.

   [student@servera ~]$ exit
   logout
   Connection to servera closed.
   [student@workstation ~]$