nerdexam
Cisco

300-910 · Question #67

Refer to the exhibit. The text represents a syslog message sent from a Linux server to a centralized log system. Based on the format of the log message, how must the functionality of the log parser be

The correct answer is B. Convert the date to the time zone of the system. To improve search capabilities for syslog messages, especially across different systems, converting the date to a consistent time zone is crucial for accurate correlation and analysis.

Logging and Monitoring

Question

Refer to the exhibit. The text represents a syslog message sent from a Linux server to a centralized log system. Based on the format of the log message, how must the functionality of the log parser be extended to improve search capabilities?

Options

  • AReverse lookup the IP address to add a hostname field
  • BConvert the date to the time zone of the system
  • CConfigure the Linux machine to add a UID field to messages
  • DFilter out the text of the message to speed up searches

How the community answered

(53 responses)
  • A
    4% (2)
  • B
    91% (48)
  • C
    6% (3)

Why each option

To improve search capabilities for syslog messages, especially across different systems, converting the date to a consistent time zone is crucial for accurate correlation and analysis.

AReverse lookup the IP address to add a hostname field

Reverse lookup of an IP address to add a hostname field might add context, but it doesn't directly improve search capabilities related to the time-based format or correlation.

BConvert the date to the time zone of the systemCorrect

Log messages often originate from systems configured with different time zones, leading to discrepancies in timestamps when aggregated. Converting all timestamps to a standardized time zone (e.g., UTC or the central log system's time zone) allows for accurate chronological searching, correlation, and analysis across all logs, significantly improving search capabilities.

CConfigure the Linux machine to add a UID field to messages

Configuring the Linux machine to add a UID field would require a change to the source system and syslog configuration, and while adding more fields can enrich logs, the question focuses on improving search based on the existing format and its common parsing challenges, especially regarding time.

DFilter out the text of the message to speed up searches

Filtering out the text of the message would reduce the information available, hindering rather than improving search capabilities, as the message content is often vital for diagnosis.

Concept tested: Log parsing and standardization (time zones)

Topics

#Logging#Log Parsing#Syslog#Time Zones

Community Discussion

No community discussion yet for this question.

Full 300-910 Practice