Selecting err and more severe priorities | LinuC Level 1 102 Exam original practice question

1.09.2Basic

In rsyslog, select err plus the more severe crit, alert, and emerg messages for every facility.

Which selector is appropriate?

Hint 1: Focus on journal storage

Separate persistent storage, runtime-only storage, automatic selection, and disabled storage behavior.

Hint 2: Key terms

Review the short definitions of journal storage, persistence, rotation, and runtime behavior involved.

Syslog selector: A log-selection expression that combines facility and priority conditions.
*.err: The selector form that includes err and more severe priorities for every facility.
err.*: A selector spelling with the facility and priority positions reversed.
err: The syslog priority representing an error condition.
Facility wildcard: The selector symbol that targets every facility.

Detailed explanation

Incorrect*.=err

Incorrect. .=err selects only exact err.

Correct*.err

Correct. *.err includes err and more severe priorities.

Incorrect*.!err

Incorrect. !err excludes err rather than selecting it.

Incorrecterr.*

Incorrect. The selector order is facility.priority.

An example you can run in a temporary verification environment.

printf '%s
' '*.err' | awk -F. '{print $1, $2}'

* err

Foundation review

Metadata that classifies a message source and its severity.

Whether systemd journal data survives a reboot and where it is stored.

A process that retains, renames, compresses, or removes log generations.

Question IDKL-102-1086

EnvironmentPOSIX awk / 模擬selectorのみ

Last technical review2026-08-13

More practice in this area