RHCSA (042): Season 2 - Scenario 17: Log Archival And Documentation Retrieval
Podcast: The RHCSA Series Podcast
- Season: 2 (Episodes 26A - 50)
- Episode: 42
- Title: RHCSA (042): Season 2 - Scenario 17: Log Archival And Documentation Retrieval
- Release date: October 6, 2026
- Produced by: Djere Services Group
- Associated article: https://djere.com/rhcsa-042-season-2-scenario-17-log-archival-and-documentation-retrieval.html
Episode 042 Executive Summary
In this Log Archival And Documentation Retrieval RHCSA lab scenario, I start performing the lab after a 6 minute introduction by the podcast hosts. You will get the most out of this lab if you listen to the entire show and then try to practice the lab several times, either along with me or by yourself. We focus on extracting critical system records and securing them for long-term retention while relying strictly on offline system manuals.
Many candidates struggle during practical exams because they try to memorize every single flag for archive utilities. When faced with a requirement to preserve advanced filesystem metadata, they panic. This scenario requires you to use the offline documentation system to discover how to retain extended attributes and SELinux contexts, and then integrate that knowledge into an automated cron job.
The core challenge involves querying the system manuals for the correct syntax, assembling the archive command for the security configuration directory, and scheduling it for recurring execution. We will use the man command for discovery, the tar utility for the archive creation, and cron for the scheduling component, followed by a robust verification process.
Keywords: rhcsa, red hat, linux, tar, archive, documentation, man, cron, scheduling
EPISODE 042: Log Archival And Documentation Retrieval
- Season: 2 | Difficulty: High
- Objectives: Primary 1.6, 1.11; Secondary 7.1
- Lab Focus: rhcsa, red hat, linux, tar, archive, documentation, man, cron, scheduling
- URL: https://djere.com/rhcsa-042-season-2-scenario-17-log-archival-and-documentation-retrieval.html
1. SCENARIO BRIEF (THE PROBLEM)
Your security compliance officer requires a nightly backup of the /etc/security directory. This backup must be compressed as a gzip archive and placed in the /opt directory. A critical stipulation is that the archive must explicitly preserve all SELinux contexts and extended attributes. You must consult the local system manuals to find the exact flags to achieve this, create the initial archive manually, and then configure a system-wide scheduled task to automate the process every night at 2:00 AM.
2. TASK ANALYSIS (THE "WHY")
- 1.11 (Documentation): Offline documentation is the ultimate lifeline. Knowing how to efficiently search man pages and info pages prevents failure when esoteric flags are required by the exam.
- 1.6 (Archive/Tar): Filesystem backups are standard operations. Using the tar utility with metadata-preserving flags ensures that restored files retain their security posture and access controls.
- 7.1 (At/Cron): Administrative tasks must be automated. Leveraging cron guarantees that the compliance backup runs consistently without manual intervention.
3. SOLUTION STEPS
Step 1: Environment Setup (Root Only)
rpm -q tar man-db cronie || dnf install -y tar man-db cronie
# We ensure the crond service is enabled and actively running to process our automated schedule
systemctl enable --now crond
Step 2: Core Implementation (Execute as root)
# We look for the terms xattrs and selinux inside the tar manual to find the exact syntax
man tar | grep -E "selinux|xattrs"
# We create the compressed archive using the flags discovered from the documentation
# The -c flag creates the archive, -z uses gzip compression, -v provides verbose output, and -f specifies the filename
# The --xattrs and --selinux flags strictly preserve the extended attributes and security contexts
tar --xattrs --selinux -czvf /opt/security-backup.tar.gz /etc/security
# We create a system-wide cron job file in the cron.d directory to automate this task
# The format specifies the minute, hour, day of month, month, day of week, the user, and the command
echo "0 2 * * * root tar --xattrs --selinux -czvf /opt/security-backup.tar.gz /etc/security" > /etc/cron.d/compliance-backup
# Technical Breakdown: The man utility parses offline documentation, which is crucial for discovering flags like --selinux. The tar command bundles the directory while holding onto the metadata, and cron executes the raw string at the specified interval.
# Pro-Tip: Be careful with absolute paths in tar. By default, tar strips the leading slash to prevent overwriting files upon extraction. Always verify the contents of your archive to ensure it captured the expected directory structure.
Step 3: Verification (The "Proof of Work")
# The -t flag lists the contents without extracting them, and -v provides the verbose detail including contexts
tar -tvf /opt/security-backup.tar.gz --selinux
* EXPECTED: A list of files from the security directory, showing their permissions, ownership, and the system_u:object_r:etc_t:s0 SELinux context.
# We verify that the scheduled task was properly placed in the system cron directory
cat /etc/cron.d/compliance-backup
* EXPECTED: 0 2 * * * root tar --xattrs --selinux -czvf /opt/security-backup.tar.gz /etc/security
4. COMPREHENSIVE CLEANUP (ZERO-TRACE)
rm -f /opt/security-backup.tar.gz /etc/cron.d/compliance-backup