Exam 350-401 topic 1 question 794 discussion

The syslog message "Nov 20 13:47:32/553 %DOT1X-5-FAIL:Authentication failed for client (e04f.438e.de4f) on interface Gi1/0/1 AudtiSessionID 0A0B50A5000004543910739E," contains the following fields: Nov 20 13:47:32/553 --> Timestamp (date & time) %DOT1X --> Facility Code (always start with the '%' sign) 5 --> Severity (0-7) FAIL --> mnemonics (categorizes the event within the facility code) "Authentication failed for client (e04f.438e.de4f) on interface Gi1/0/1 AudtiSessionID 0A0B50A5000004543910739E" --> message-text (condition of the vent that triggered the system message) "drops" keyword ---> used to drop the message that matches the pattern specified by the discriminator "logging host 10.15.20.33 discriminator DOT1X" ---> assigns the discriminator with a Syslog server @ 10.15.20.33

DOT1X-5-FAIL: facility: dot1x severity:5 mnemonic:fail seq no:timestamp: %facility-severity-MNEMONIC:description

A is correct

A is the correct one

A is correct

A. logging discriminator DOT1X facility drops DOT1X logging host 10.15.20.33 discriminator DOT1X Explanation: The logging discriminator command creates a discriminator named DOT1X. The facility drops DOT1X part specifies that messages with a facility that includes DOT1X should be dropped. The logging host 10.15.20.33 discriminator DOT1X command sends log messages to the Syslog server at 10.15.20.33, but only those that do not match the discriminator criteria (i.e., excluding DOT1X messages).

logging discriminator DOT1X facility drops DOT1X: This command creates a logging discriminator named "DOT1X" and configures it to drop syslog messages with the facility "DOT1X". So, any syslog messages with the facility "DOT1X" will be dropped (not logged). logging host 10.15.20.33 discriminator DOT1X: This command specifies that syslog messages that match the criteria defined by the discriminator "DOT1X" are sent to the syslog server at the IP address 10.15.20.33. So, syslog messages that pass through the "DOT1X" discriminator (i.e., not dropped based on the first command) will be sent to the specified syslog server.

Logging discriminator discr-name [ [facility] [mnemonics] [msg-body] { drops string | includes string } ] [ severity { drops sev-num | includes sev-num } ] [ rate-limit msglimit ]

filters out facility=DOT1X messages and drops them

it should be A

I think that the correct answer should be A). logging discriminator DOT1X facility drops DOT1X logging host 10.15.20.33 discriminator DOT1X

Given answer is wrong. The message body doesn't contain "DOT1X". However the logging facility is "DOT1X" so A seems good. https://youtu.be/Lbb7vlQoGt0?feature=shared&t=154