RHEL Linux - Red Hat System Administration Practice Exam

If you want to display only journal messages from the systemd process, which command is correct?

1. journalctl _UID=1

2. journalctl _UID=1000

3. journalctl _PID=1

4. journalctl _PID=1000

The correct answer is: journalctl _PID=1

The command to use for displaying only journal messages from the systemd process is based on the process identifier (PID) associated with systemd. The systemd process typically has a PID of 1 in a standard system configuration, as it is the first process started by the Linux kernel during system boot. When utilizing the command `journalctl _PID=1`, you are specifically filtering the log entries to show only those associated with the PID of 1, which corresponds to the systemd process. This effectively narrows down the log output to include only relevant messages directly from systemd, such as service start and stop messages, journal management, and other related system events. This command is particularly useful for troubleshooting or monitoring system services and their status, allowing administrators to focus on the logs produced by the system’s init system without sifting through numerous messages generated by other services and processes. In contrast, using the UID filter or different PIDs does not target the systemd process correctly. While UID refers to user identifiers and can include processes owned by different users, it does not specifically correlate to systemd as it runs with the UID 0 (root) by default. Filtering based on the PID of 1000 would potentially target a common user session process