$ Linux One Liners
Back to cert prep

Practice area

LPIC-1 102: Essential System Services

Inspect clocks, logs, log rotation, mail routing basics, and print queues before changing service configuration.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Source status

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

This page paraphrases study areas into command practice. It does not copy official objective text wholesale and is not an exam dump.

Plain-English goal

Practice area: system time, time synchronization, logging, log rotation, mail basics, and printing. Exam/domain: 102-500.

read the situation

Command, output, and next step

Command anatomy

date -Is; timedatectl 2>/dev/null | sed -n '1,12p'; chronyc tracking 2>/dev/null | sed -n '1,12p'
date
the command family
flags
change output shape or scope
target
the file, service, user, mount, or host being inspected
output
evidence you must explain before changing state

Annotated output

Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice

Usage
the command shape and expected target
--help
quick option reference
man
full local manual page when installed

Safe vs unsafe move

Common wrong move

Treating a practice command as a permission to make a broad production change.

Next safe command

command --help

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

How to get help

  1. Know the commandUse command --help, then man command for the full reference.
  2. Know the conceptUse apropos keyword or man -k keyword to discover command names.
  3. Maybe a shell builtinUse type command, command -V command, then help command.
  4. Service behaviorUse systemctl status service and journalctl -u service before restarting.
  5. Package ownershipUse dpkg -S, rpm -qf, or the distro package tool for the installed file.

Study plan

  1. Prove current time, timezone, hardware-clock relationship, and time synchronization before blaming logs or certificates.
  2. Practice reading logs from journald and traditional files; understand persistence, facility/severity concepts, and log rotation.
  3. Learn MTA basics enough to inspect aliases, queues, forwarding, and local delivery clues without pretending to be a mail admin.
  4. Practice printer basics: CUPS service, queues, jobs, default printer, and safe cancellation of your own print jobs.

Command labs

Run these in a lab shell or disposable machine first. The point is to explain the output, not just memorize the command.

Read time sync state

date -Is; timedatectl 2>/dev/null | sed -n '1,12p'; chronyc tracking 2>/dev/null | sed -n '1,12p'

Current time, timezone, NTP sync state, and chrony tracking should be explainable if present.

Annotated output 
Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice: Usage, --help, man.

Next safe command: command --help

Read logs and rotation config

journalctl -p warning -b --no-pager | head -40; logrotate -d /etc/logrotate.conf 2>/dev/null | head -40

Recent warnings and logrotate debug output should be visible without rotating logs.

Annotated output 
nginx.service - A high performance web server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
   Active: failed (Result: exit-code) since Fri 2026-07-03 10:12:04 CDT
Jul 03 10:12:04 web01 nginx[2310]: nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (13: Permission denied)

What to notice: Loaded, Active, Result, log message.

Next safe command: nginx -t

Inspect print queues

lpstat -t 2>/dev/null || lpq 2>/dev/null || true

Printer and queue state should be visible if CUPS/lpr tooling is installed.

Annotated output 
Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice: Usage, --help, man.

Next safe command: command --help

command families

Commands to practice

  • date
  • timedatectl
  • chronyc
  • journalctl
  • logger
  • rsyslog
  • logrotate
  • mailq
  • aliases
  • lpstat
  • lpq
  • lprm

Related command pages

Related drills

Flashcards

Why check time before debugging certificates or logs?

Wrong system time can make TLS, cron, logs, and ordering look broken.

What does journalctl -b scope?

Logs from the current boot.

Why use logrotate -d?

It debugs rotation decisions without rotating files.

What does lpstat help inspect?

CUPS printer and queue status.

Quick quiz

Check the reasoning locally in your browser. Answers are not sent anywhere.

Which command shows systemd time sync and timezone state?
Show answer

Answer: timedatectl

Why: timedatectl reports local/UTC time, timezone, and sync state.

  • chmod: That changes access broadly before proving which path component or owner is wrong.
  • xargs: That does not answer the question the output is asking you to prove first.
  • rpm -qf: That does not answer the question the output is asking you to prove first.
Which logrotate mode is safest for review?
Show answer

Answer: logrotate -d

Why: -d is debug mode; it does not rotate.

  • logrotate -f: That does not answer the question the output is asking you to prove first.
  • rm /var/log/*: That destroys or removes state before the evidence is understood.
  • journalctl --vacuum-time=1s: That does not answer the question the output is asking you to prove first.
Which command family fits printer queue inspection?
Show answer

Answer: lpstat/lpq

Why: lpstat and lpq report print queue state.

  • dig/host: That does not answer the question the output is asking you to prove first.
  • useradd/usermod: That does not answer the question the output is asking you to prove first.
  • mkfs/fsck: That destroys or removes state before the evidence is understood.

case practice

Log investigation mini-cases

Read the evidence, pick the next safe command, then reveal the reasoning.

A service failed after reboot. The only visible symptom is a red failed-unit line.

nginx.service loaded failed failed A high performance web server

Best next command?

Log timestamps appear out of order after a laptop was powered off.

System clock synchronized: no
NTP service: inactive

Best next command?

Self-test before moving on