Exam Essentials

Know which daemon controls system auditing. Auditing is controlled by the syslogd daemon.

Know which configuration file contains the option to enable remote logging. The option LOG_FROM_REMOTE=YES is contained in the /etc/default/syslogd file.

Know how to read the /etc/syslog.conf file. All entries start with a keyword pair of facility.level. Then, after a tab, an action is specified, such as writing to a file or sending a message to a logged-in user's console.

Know the facilities in syslog.conf. The possible facilities are user, kern , mail, daemon, auth, lpr, news, uucp, cron, local0-7, mark, and * (meaning all).

Know the levels of severity of events in syslog.conf. From most severe to least, the levels are emerg, alert, crit, err, warning, notice, info, debug, and none.

Know how to manually add entries to the system log. Logs are manually updated with the logger command.

Know what inetd is responsible for. The Internet services daemon is responsible for listening for and responding to all incoming TCP and UDP connections.