journalctl用法详解

港控/mmm° 2023-10-05 17:07 32阅读 0赞

#### 文章目录 ####

*  一、journalctl命令简述
 *  二、journalctl常用选项

## 一、journalctl命令简述 ##

journalctl [OPTIONS...] [MATCHES...]

Query the journal.

Flags:
         --system              Show the system journal
         --user                Show the user journal for the current user
      -M --machine=CONTAINER   Operate on local container
      -S --since=DATE          Show entries not older than the specified date
      -U --until=DATE          Show entries not newer than the specified date
      -c --cursor=CURSOR       Show entries starting at the specified cursor
         --after-cursor=CURSOR Show entries after the specified cursor
         --show-cursor         Print the cursor after all the entries
      -b --boot[=ID]           Show current boot or the specified boot
         --list-boots          Show terse information about recorded boots
      -k --dmesg               Show kernel message log from the current boot
      -u --unit=UNIT           Show logs from the specified unit
      -t --identifier=STRING   Show entries with the specified syslog identifier
      -p --priority=RANGE      Show entries with the specified priority
      -e --pager-end           Immediately jump to the end in the pager
      -f --follow              Follow the journal
      -n --lines[=INTEGER]     Number of journal entries to show
         --no-tail             Show all lines, even in follow mode
      -r --reverse             Show the newest entries first
      -o --output=STRING       Change journal output mode (short, short-iso,
                                       short-precise, short-monotonic, verbose,
                                       export, json, json-pretty, json-sse, cat)
         --utc                 Express time in Coordinated Universal Time (UTC)
      -x --catalog             Add message explanations where available
         --no-full             Ellipsize fields
      -a --all                 Show all fields, including long and unprintable
      -q --quiet               Do not show privilege warning
         --no-pager            Do not pipe output into a pager
      -m --merge               Show entries from all available journals
      -D --directory=PATH      Show journal files from directory
         --file=PATH           Show journal file
         --root=ROOT           Operate on catalog files underneath the root ROOT
         --interval=TIME       Time interval for changing the FSS sealing key
         --verify-key=KEY      Specify FSS verification key
         --force               Override of the FSS key pair with --setup-keys
    
    Commands:
      -h --help                Show this help text
         --version             Show package version
      -F --field=FIELD         List all values that a specified field takes
         --new-id128           Generate a new 128-bit ID
         --disk-usage          Show total disk usage of all journal files
         --vacuum-size=BYTES   Reduce disk usage below specified size
         --vacuum-time=TIME    Remove journal files older than specified date
         --flush               Flush all journal data from /run into /var
         --header              Show journal header information
         --list-catalog        Show all message IDs in the catalog
         --dump-catalog        Show entries in the message catalog
         --update-catalog      Update the message catalog database
         --setup-keys          Generate a new FSS key pair
         --verify              Verify journal file consistency

## 二、journalctl常用选项 ##

1.  journalctl -e // Immediately jump to the end in the pager(立即跳到日志页面结尾处)

journalctl -e

1月 04 18:30:32 server1 systemd[1]: Started Session 22 of user root.
    1月 04 18:30:32 server1 systemd[1]: Starting Session 22 of user root.
    1月 04 18:30:32 server1 CROND[55734]: (root) CMD (/usr/lib64/sa/sa1 1 1)
    1月 04 18:40:01 server1 systemd[1]: Started Session 23 of user root.
    1月 04 18:40:01 server1 systemd[1]: Starting Session 23 of user root.
    1月 04 18:40:01 server1 CROND[55818]: (root) CMD (/usr/lib64/sa/sa1 1 1)
    1月 04 18:50:01 server1 systemd[1]: Started Session 24 of user root.
    1月 04 18:50:01 server1 systemd[1]: Starting Session 24 of user root.
    1月 04 18:50:01 server1 CROND[55907]: (root) CMD (/usr/lib64/sa/sa1 1 1)
    1月 04 19:00:01 server1 systemd[1]: Started Session 25 of user root.
    1月 04 19:00:01 server1 systemd[1]: Starting Session 25 of user root.
    1月 04 19:00:01 server1 CROND[55997]: (root) CMD (/usr/lib64/sa/sa1 1 1)
    1月 04 19:01:01 server1 systemd[1]: Started Session 26 of user root.
    1月 04 19:01:01 server1 systemd[1]: Starting Session 26 of user root.
    1月 04 19:01:01 server1 CROND[56011]: (root) CMD (run-parts /etc/cron.hourly)
    1月 04 19:01:01 server1 run-parts(/etc/cron.hourly)[56014]: starting 0anacron
    1月 04 19:01:01 server1 run-parts(/etc/cron.hourly)[56020]: finished 0anacron
    1月 04 19:10:01 server1 systemd[1]: Started Session 27 of user root.
    1月 04 19:10:01 server1 systemd[1]: Starting Session 27 of user root.
    1月 04 19:10:01 server1 CROND[56105]: (root) CMD (/usr/lib64/sa/sa1 1 1)

1.  journalctl -u //查看指定单元 ( unit ) 的日志

journalctl -u httpd

[root@server1 ~]# journalctl -u httpd
    -- Logs begin at 日 2020-11-22 04:33:29 CST, end at 一 2021-01-04 19:30:01 CST. --
    1月 04 19:24:46 server1 systemd[1]: Starting The Apache HTTP Server...
    1月 04 19:25:06 server1 httpd[56288]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::4f00:5a8e:3923:429d. Set the 'ServerName' directive 
    1月 04 19:25:26 server1 systemd[1]: Started The Apache HTTP Server.
    1月 04 19:27:57 server1 systemd[1]: Stopping The Apache HTTP Server...
    1月 04 19:27:58 server1 systemd[1]: Stopped The Apache HTTP Server.