---
id: task_log_syslog_services
name: Linux Syslog - Service Start/Stop Summary
category: log_analysis
grading_type: hybrid
timeout_seconds: 180
workspace_files:
  - dest: "syslog.log"
    source: "logs/linux_syslog.log"
---

# Linux Syslog - Service Start/Stop Summary

## Prompt

Analyze the Linux syslog at `syslog.log` and produce a summary of all service start and stop events. The log is from a server named "combo" running Linux 2.6.

Your report should include:

1. **Service Inventory**: List every service mentioned in the log with startup or shutdown events
2. **System Boot Events**: Identify all system boots/restarts by finding clusters of service startups
3. **Per-Service Status**: For each service, list all start/stop events with timestamps
4. **CUPS Special Case**: The CUPS print service has frequent restarts — document its pattern separately
5. **Service Dependencies**: Based on startup ordering, infer which services start first (core OS) vs later (applications)
6. **Uptime Estimate**: Based on boot events, estimate the server's uptime between restarts

Write the report to `service_status_report.md` as a well-structured markdown document.

---

## Expected Behavior

The agent should identify:

**System Boots (3 detected):**
1. Jun 9 ~06:06 — Full boot (syslogd, klogd, kernel, irqbalance, portmap, etc.)
2. Jun 10 ~11:32 — Full boot (same service sequence)
3. Jul 27 ~14:42 — Another boot event

**Service Inventory (20+ services with startup events):**
- Core: syslogd, klogd, irqbalance, portmap
- Network: rpc.statd, rpc.idmapd, sendmail, sm-client, named
- Security: spamd, privoxy
- Hardware: bluetooth (hcid, sdpd), smartd, apmd, gpm
- Printing: cupsd (17 startups!)
- Scheduling: crond, anacron, xinetd
- Web: htt

**CUPS Pattern:**
- cupsd has 17 startup events and 15 shutdown events
- Regular weekly pattern: shutdown early morning (04:0x) followed by startup
- This matches logrotate triggering CUPS restart

**Service Dependencies (boot order):**
1. syslogd, klogd (logging first)
2. kernel messages
3. irqbalance, portmap (system services)
4. Network services (rpc, named)
5. Application services (cups, cron, sendmail)

Acceptable variations:
- Boot detection approaches may differ
- Service categorization is subjective
- Uptime calculations are approximate

---

## Grading Criteria

- [ ] `service_status_report.md` is created in the workspace
- [ ] System boot events are identified (at least 2 boots found)
- [ ] Services are listed with their start/stop events
- [ ] CUPS frequent restarts are noted (17 startups)
- [ ] Service startup ordering is analyzed

---

## Automated Checks

```python
def grade(transcript: list, workspace_path: str) -> dict:
    """Grade the Linux syslog service status summary task."""
    from pathlib import Path

    scores = {}
    workspace = Path(workspace_path)
    report_file = workspace / "service_status_report.md"

    if not report_file.exists():
        return {
            "output_created": 0.0,
            "boots_identified": 0.0,
            "services_listed": 0.0,
            "cups_pattern": 0.0,
            "startup_ordering": 0.0,
        }

    scores["output_created"] = 1.0
    content = report_file.read_text(encoding="utf-8").lower()

    # Check 1: Boot events identified
    boot_dates = ["jun 9", "jun 10", "jul 27", "june 9", "june 10", "july 27"]
    boots_found = sum(1 for d in boot_dates if d in content)
    has_boot = any(kw in content for kw in ["boot", "restart", "reboot", "startup"])
    scores["boots_identified"] = (
        1.0 if boots_found >= 2 and has_boot else
        0.5 if boots_found >= 1 else 0.0
    )

    # Check 2: Services listed
    services = ["syslogd", "klogd", "crond", "cupsd", "cups", "sendmail",
                "portmap", "sshd", "named", "xinetd", "smartd", "gpm"]
    services_found = sum(1 for s in services if s in content)
    scores["services_listed"] = (
        1.0 if services_found >= 6 else
        0.5 if services_found >= 3 else 0.0
    )

    # Check 3: CUPS pattern noted
    has_cups = "cups" in content
    has_frequent = any(kw in content for kw in ["17", "frequent", "multiple",
                                                  "regular", "weekly", "logrotate"])
    scores["cups_pattern"] = (
        1.0 if has_cups and has_frequent else
        0.5 if has_cups else 0.0
    )

    # Check 4: Startup ordering analyzed
    order_keywords = ["order", "first", "before", "after", "sequence",
                      "dependency", "boot order", "startup order"]
    scores["startup_ordering"] = (
        1.0 if sum(1 for kw in order_keywords if kw in content) >= 2 else
        0.5 if sum(1 for kw in order_keywords if kw in content) >= 1 else 0.0
    )

    return scores
```

---

## Additional Notes

**Key facts from the log:**

- Server: "combo", Fedora/Red Hat, Linux 2.6.5-1.358
- 3 full system boots detected in the log
- CUPS restarts weekly — likely triggered by logrotate
- 20+ unique services with startup events
- The boot sequence is consistent across all 3 boots
- Boot sequence shows clear ordering: logging → system → network → application services

**Grading weights (equal):** Each of the five criteria contributes 0.2 to the final score.