Question
A systems administrator manages multiple Linux servers and needs to set up a reliable and secure way to handle the complexity of managing event records on the OS and application levels. Which of the following should the administrator do?
- A. Create an automated process to retrieve logs from the server by demand.
- B. Implement a centralized log aggregation solution. Correct
- C. Configure daily automatic backups of logs to remote storage.
- D. Deploy log rotation procedures to manage the records.
Explanation
A centralized log aggregation solution (for example rsyslog or journald forwarding to a central collector or a SIEM) gathers OS and application events from every server into one secured, searchable place, which is what reliably handles log complexity across many hosts. Pulling logs on demand is manual and misses events if a server fails. Remote backups preserve logs but do not make them manageable or analysable. Log rotation only controls disk usage on each server and does not address multi-server management.
