Hazel, a forensic investigator, is analyzing the SSH logs on a Linux server using journalctl. She needs to extract the fingerprint of the SSH key…

The journalctl command is used to query and display logs from the systemd journal. To view the logs specifically for the SSH service (sshd), the -u or --unit flag is used, followed by the service name (ssh or sshd). The command journalctl -u ssh will display all journal entries for the specified unit from the beginning of the log. The SSH server's key fingerprint is logged when the service starts, so this command allows an investigator to review the service's entire history to find that information.

A. This command is too specific; it only shows logs since yesterday, potentially missing the relevant service start-up entry if it occurred earlier.

B. The -f flag follows the log in real-time, which is for live monitoring, not for searching historical entries where the fingerprint was logged.

C. This command is highly restrictive, showing only logs from the last hour, which is unlikely to contain the initial service start-up log.

1. journalctl man page. (n.d.). In Linux man pages. Retrieved from a standard Linux distribution (e.g.

by running man journalctl). The documentation specifies that -u

--unit=UNIT|PATTERN "Show messages for the specified systemd unit UNIT...".

2. Red Hat Enterprise Linux Documentation. (n.d.). "Chapter 12. Viewing logs with journalctl". System Administrator's Guide. This official vendor documentation explains the usage of journalctl -u to filter logs by a specific service unit.

3. Poettering

L. (n.d.). systemd for Administrators

Part XVII: Using the Journal. This series of articles by the creator of systemd provides authoritative insight into its components

including the intended use of journalctl for querying logs.