Which command filters logs by time when creating a support bundle?

• A. journalctl --since
• B. /var/log
• C. dmesg
• D. sha256sum

Answer: (A)

Filtering logs by a specific time window is essential when building a targeted support bundle. The tool that provides time-based filtering for system logs is journalctl, which can limit what you retrieve using options like --since and --until. With --since you specify the start of the window (for example, since "1 hour ago" or since "2024-05-01 12:00:00"), and you can pair it with --until to set an end time. This lets you pull just the entries from the exact period you care about, keeping the bundle smaller and more relevant.

The other options don’t filter by time. /var/log is simply the location of log files, not a filter by date. dmesg shows kernel messages but doesn’t apply a time filter unless you manually parse timestamps. sha256sum computes a hash of files and has no log-filtering capability.