System Logging (syslog & journald)

syslog groups messages by facility. Which facilities are reserved for admins to use freely, and why is authpriv treated more carefully than auth?

Apache, MySQL, CUPS, and Samba all write logs, yet none of them are affected when you edit the central syslog configuration. Why do they escape it, and where do their logs come from instead?

An rsyslogd rule looks like mail.err written before /var/log/mail.err. What are the two structural halves of every such rule, and what does each one decide?

Kernel messages land in a fixed 16 KiB RAM ring buffer. What happens to old kernel messages over time, and how does that structure make persistent kernel logs a separate concern?

Left alone, log files grow without bound. What sequence of actions does logrotate perform on a log, and how often is it triggered?

logwatch is meant to save you from reading raw logs, but on a freshly configured box its daily report never arrives. What does logwatch do, and what dependency silently blocks it?

A security auditor complains that on a syslog-based host an intruder could quietly edit /var/log to erase their tracks. What does systemd's journal change about that, and what does it trade away to get it?

After a reboot on a RHEL box, all of yesterday's journal entries are gone. What determines whether the journal survives a reboot, and how do you make it persistent?

You run journalctl with no options on a busy server and it dumps millions of oldest-first entries. Which filter flags cut that down to what you usually want, such as this boot, a single service, or a live tail?

The journal keeps eating disk. Which journald.conf setting actually caps its footprint by default, what is that default, and how do you reclaim space right now without waiting for rotation?

You're testing a new rsyslog rule and need to inject a message from the shell without waiting for a real event. Which command does this, and what does it add for you automatically?

You write the selector mail.err. A colleague expects it to capture only error-level mail messages, but it captures more than that. Which messages actually match, and how would you restrict it to exactly one level?

In an rsyslogd action, some file destinations are written with a leading minus sign, such as a minus in front of /var/log/syslog. What does that minus change, and what is the risk you accept for it?

On a fresh Fedora or recent RHEL box there is no rsyslogd and no text logs in /var/log. Is that a misconfiguration, and how would you get text-format logs back?

You need to change what rsyslogd logs on an Ubuntu server. Which files hold its configuration, where do most Ubuntu rules actually live, and what must you do after editing?

A single rsyslog selector field can list several services and even several facility.priority pairs at once. What are the two separators, and what does each one combine?

Name the syslog priority levels from least to most important, and three level keywords the book says you should stop using.

Besides writing to a log file, an rsyslog action can hand the message to a pipe or blast it to everyone logged in. Which action syntaxes do those, and when is the broadcast used?

dmesg timestamps look like [1234.567890]. What do those numbers actually measure, and why can dmesg -T's human-readable times be wrong on a VM?

Your logrotate config sets delaycompress. What problem does it prevent, and which archive does it leave uncompressed for one extra cycle?

The files in /etc/logrotate.d don't ship with the logrotate package itself. Where do they come from, and what problem does that sourcing solve?

Skim a logrotate snippet and you'll see keywords like rotate, missingok, notifempty, create, and postrotate. What does each of these common directives control?

logwatch works with zero setup, yet you want to change its recipient and detail level. Where is its default config, which three settings control mail/period/verbosity, and how do you override them safely?

If the systemd journal is technically superior and syslog-compatible, why do so many distributions still bolt rsyslogd alongside it and log everything twice?

You only want warnings-and-worse out of the journal, and just the last 20 of them. Which journalctl flags do that, and what is the priority-number scale?

Beyond -b and -f, how do you make journalctl show only kernel messages, only a logger tag, only one syslog facility, or split system vs user logs?

A service refuses to start and gives no clue why. Why is /var/log the first place to look, and what second job do those same files do once the service is running?

You want journald to stop forwarding to a syslog service and to keep storing debug-level messages. Which config file (plus drop-in dirs) do you edit, and which two parameters control those behaviors?