Which of the following statements about systemd-journald are true? (Choose three.)

Question

Options

• AIt is incompatible with syslog and cannot be installed on a system using regular syslog.
• BIt only processes messages of systemd and not messages of any other tools.
• CIt can pass log messages to syslog for further processing.
• DIt maintains metadata such as _UID or _PID for each message.
• EIt supports syslog facilities such as kern, user, and auth.

• A
  11% (5)
• B
  17% (8)
• C
  72% (33)

Explanation

C, D, and E are correct because systemd-journald is designed to coexist with and complement traditional syslog infrastructure, not replace it.

• C is correct: journald can forward log messages to a syslog socket (e.g., /run/systemd/journal/syslog), allowing traditional syslog daemons like rsyslog to pick them up for further filtering, storage, or forwarding.
• D is correct: One of journald's key strengths is automatic metadata tagging - every message is stamped with fields like _UID, _PID, _COMM, _EXE, and more, enabling precise filtering that plain syslog cannot provide.
• E is correct: journald understands standard syslog facilities (kern, user, auth, daemon, etc.) and priority levels, maintaining compatibility with the syslog API.

A is wrong because journald and syslog are fully compatible and commonly run side-by-side - journald can act as a syslog replacement, supplement, or forwarder. B is wrong because journald collects messages from the kernel, boot process, services, and any application writing to the journal API or syslog socket - not just systemd itself.

Memory tip: Think of journald as a superset of syslog - it speaks syslog's language (facilities/priorities → E), adds rich metadata (C, D), and can hand messages off to syslog (C). The only things it can't do are the wrong answers.

No community discussion yet for this question.