首页 › 运维游艺 › journalctl浣跨敤鏂规硶 (journalctl鏌ョ湅鏃ュ織)

journalctl浣跨敤鏂规硶 (journalctl鏌ョ湅鏃ュ織)

🏷️ 运维游艺 ✍️ 一个需要努力，更需要大家支持的人 📅 2021-03-01 05:27:30

journalctl工具是在centos7之后出现的工具。

在Systemd出现之前，Linux系统及各应用的日志都是分别管理的，Systemd开始统一管理了所有Unit的启动日志，这样带来的好处就是可以只用一个 journalctl命令，查看所有日志（内核日志和 应用日志）。

日志的配置文件`/etc/systemd/journald.conf`

参数：

-b 查看本次启动的所有日志 或者什么也不加，journalctl

[root@vrgv ~]# journalctl -b

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Feb 18 10:37:48 vrgv systemd-journal[197]: Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free

Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408

Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 

Feb 18 10:37:48 vrgv kernel: Disabled fast string operations

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'

-k 查看内核日志


[root@vrgv ~]# journalctl -k

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408

Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 

Feb 18 10:37:48 vrgv kernel: Disabled fast string operations

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

-u 根据类型查询，如查看docker服务日志journalctl -u docker



[root@vrgv ~]# journalctl -u docker.service

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Feb 18 10:37:59 vrgv systemd[1]: Starting Docker Application Container Engine...

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.798907622+08:00" level=info msg="libcontainerd: started 

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.801937970+08:00" level=info msg="parsed scheme: \"unix\"

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.802051497+08:00" level=info msg="scheme \"unix\" not reg

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.806551815+08:00" level=info msg="ccResolverWrapper: send

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.806638857+08:00" level=info msg="ClientConn switching ba

Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.808453873+08:00" l

--since "2017-01-10" --until "2017-01-11 03:00" 查看2017.1.10到2017.1.11 3点的日志，也可简写成-S和-U


[root@vrgv ~]# journalctl -S "2021-03-01 11:00" -U "2021-03-01 12:00"

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Mar 01 11:00:13 vrgv systemd[1]: Starting Cleanup of Temporary Directories...

Mar 01 11:00:13 vrgv systemd[1]: Started Cleanup of Temporary Directories.

Mar 01 11:01:01 vrgv systemd[1]: Started Session 307 of user root.

Mar 01 11:01:01 vrgv CROND[129463]: (root) CMD (run-parts /etc/cron.hourly)

Mar 01 11:01:01 vrgv run-parts(/etc/cron.hourly)[129466]: starting 0anacron

_UID 查看某个用户的日志，如查看postgres用户日志journalctl _UID=1000 (1000是根据命令id -u postgres得到的)


[root@vrgv ~]# id -u postgres

1000

[root@vrgv ~]# journalctl _UID=1000

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.254 EST [10206] LOG:  listening on IPv4 address "0.0.0.0", port

Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.254 EST [10206] LOG:  listening on IPv6 address "::", port 5432

Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.264 EST [10206] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5

Feb 18 10:38:00 vrgv pg_ctl[10180]: 2021-02-17 21:38:00.083 EST [10206] LOG:  redirecting log output to l

-p 显示特定优先级的信息，从而过滤掉优先级较低的信息



    0: emerg       紧急

    1: alert       警惕

    2: crit        警示

    3: err         错误

    4: warning     警告

    5: notice      注意，通告

    6: info        信息

    7: debug       调试

[root@vrgv ~]# journalctl -p 3 -b

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --

Feb 18 10:37:50 vrgv kernel: sd 2:0:0:0: [sda] Assuming drive cache: write through

Feb 18 10:37:50 vrgv kernel: sd 2:0:1:0: [sdb] Assuming drive cache: write through

Feb 18 10:37:50 vrgv kernel: sd 2:0:2:0: [sdc] Assuming drive cache: write through

Feb 18 10:37:51 vrgv systemd-udevd[5107]: unknown key 'PHYSDEVBUS' in /etc/udev/rules.d/80-hasp.rules:9

Feb 18 10:37:51 vrgv systemd-udevd[5107]: invalid rule '/etc/udev/rules.d/80-hasp.rules:9'

Feb 18 10:37:51 vrgv systemd-udevd[5107]: unknown key 'PHYSDEVBUS' in /etc/udev/rules.d/80-hasp.rules:10

Feb 18 10:37:51 vrgv systemd-udevd[5107]: invalid rule '/etc/udev/rules.d/80-hasp.rules:10'

Feb 18 10:37:52 vrgv kernel: piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!

-a 与-p相反，-a代表全部显示



[root@vrgv ~]# journalctl -a

-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 13:01:01 CST. --

Feb 18 10:37:48 vrgv systemd-journal[197]: Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free

Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408

Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 

Feb 18 10:37:48 vrgv kernel: Disabled fast string operations

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'

Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

-o 指定日志输出格式，最为常见的格式：-o json-pretty


cat: 只显示信息字段本身。

export: 适合传输或备份的二进制格式。

json: 标准JSON，每行一个条目。

json-pretty: JSON格式，适合人类阅读习惯。

json-sse: JSON格式，经过打包以兼容server-sent事件。

short: 默认syslog类输出格式。

short-iso: 默认格式，强调显示ISO 8601挂钟时间戳。

short-monotonic: 默认格式，提供普通时间戳。

short-precise: 默认格式，提供微秒级精度。

verbose: 显示该条目的全部可用journal字段，包括通常被内部隐藏的字段。

[root@vrgv ~]# journalctl -o json-pretty -b

{

        "__CURSOR" : "s=fb03d2b00f8e4804ae90d1272f9ac3f2;i=1;b=66afbb5671e04f30b082eed2c2ff5402;m=23a7fc;t=5bb9338a8743e;x=acbe13f9

        "__REALTIME_TIMESTAMP" : "1613615868703806",

        "__MONOTONIC_TIMESTAMP" : "2336764",

        "_BOOT_ID" : "66afbb5671e04f30b082eed2c2ff5402",

        "PRIORITY" : "6",

        "_TRANSPORT" : "driver",

        "MESSAGE" : "Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free of 7.7G available \uffffffe2\ufff

        "MESSAGE_ID" : "ec387f577b844b8fa948f33cad9a75e6",

        "_PID" : "197",

        "_UID" : "0",

        "_GID" : "0",

        "_COMM" : "systemd-journal",

        "_EXE" : "/usr/lib/systemd/systemd-journald",

        "_CMDLINE" : "/usr/lib/systemd/systemd-journald",

        "_CAP_EFFECTIVE" : "25402800cf",

        "_SYSTEMD_CGROUP" : "/system.slice/systemd-journald.service",

        "_SYSTEMD_UNIT" : "systemd-journald.service",

        "_SYSTEMD_SLICE" : "system.slice",

        "_MACHINE_ID" : "92dcecad2935477796367be725a6735b",

        "_HOSTNAME" : "vrgv"

}

-f 持续实时输入日志

[root@vrgv ~]# journalctl -fu docker.service

-- Logs begin at Thu 2021-02-18 10:37:48 CST. --

Feb 18 10:38:00 vrgv dockerd[10179]: time="2021-02-18T10:38:00.241741884+08:00" level=info msg="Loading containers: start."

Feb 18 10:38:01 vrgv dockerd[10179]: time="2021-02-18T10:38:01.610646278+08:00" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set a preferred IP address"

Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.143827293+08:00" level=info msg="Loading containers: done."

Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.250503801+08:00" level=info msg="Docker daemon" commit=481bc77 graphdriver(s)=overlay2 version=18.09.6

Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.250847585+08:00" level=info msg="Daemon has completed initialization"

Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.277582884+08:00" level=info msg="API listen on /var/run/docker.sock"

Feb 18 10:38:02 vrgv systemd[1]: Started Docker Application Container Engine.

另外几种查看信息的

查看日志占用磁盘空间大小

[root@k8s-node1 ~]# journalctl --disk-usage 

Archived and active journals take up 87.6M on disk.

设置日志占用磁盘空间


[root@k8s-node1 ~]# journalctl --vacuum-size=500M

Vacuuming done, freed 0B of archived journals on disk.

设置日志最长保留时间

month/years


[root@k8s-node1 ~]# journalctl --vacuum-time=1month

Vacuuming done, freed 0B of archived journals on disk.

最后看一下配置文件

[root@k8s-node1 ~]# vim /etc/systemd/journald.conf

#  This file is part of systemd.

#

#  systemd is free software; you can redistribute it and/or modify it

#  under the terms of the GNU Lesser General Public License as published by

#  the Free Software Foundation; either version 2.1 of the License, or

#  (at your option) any later version.

#

# Entries in this file show the compile time defaults.

# You can change settings by editing this file.

# Defaults can be restored by simply deleting this file.

#

# See journald.conf(5) for details.

[Journal]

#Storage=auto

#Compress=yes

#Seal=yes

#SplitMode=uid

#SyncIntervalSec=5m

#RateLimitInterval=30s

#RateLimitBurst=1000

#SystemMaxUse=

#SystemKeepFree=

#SystemMaxFileSize=

#RuntimeMaxUse=

#RuntimeKeepFree=

#RuntimeMaxFileSize=

#MaxRetentionSec=

#MaxFileSec=1month

#ForwardToSyslog=yes

#ForwardToKMsg=no

#ForwardToConsole=no

#ForwardToWall=yes

#TTYPath=/dev/console

#MaxLevelStore=debug

#MaxLevelSyslog=debug

#MaxLevelKMsg=notice

#MaxLevelConsole=info

#MaxLevelWall=emerg

#LineMax=48K