RHEL Linux - Red Hat System Administration Practice Exam

The command used to monitor system log messages in RHEL is `journalctl`. This utility is specifically designed to query and display logs from the systemd journal, which is the logging system used in RHEL and many other modern Linux distributions. The journal captures logs from various services and system components, providing a centralized location for system log management.

Using `journalctl`, administrators can view logs in real-time, filter by time or service, and access logs that could span back to the system's boot time. This command offers powerful options, such as displaying logs for the current boot session, following logs as they are written (similar to using `tail` with the `-f` option), and showing logs for specific services.

While other options, like `logwatch`, are useful for analyzing logs or generating reports based on log data, they do not provide direct monitoring capabilities. The `syslog` command traditionally refers to the log management system rather than a specific command. Though `tail` can monitor and display the end of log files in real-time, it is not specific to system logs in a comprehensive way unless specifically pointed to a log file.

Thus, `journalctl` is the most appropriate choice for actively monitoring system logs in RHEL.