文章目录
前言
日志的采集是由各个程序来完成的,因为你的程序会将自己的某些执行信息书写到日志中。
而journald和rsyslog是用来采集日志的,并以某种格式保存。在企业7之前只有rsyslog。在企业7之后两个都有。
journald是无法关闭的。
在系统中做任何重大的设置修改,都会产生日志。
- 实验环境
rhel7_node1:172.25.254.10
rhel8_node1:172.25.254.11
journald
服务名称:systemd-journald.service
[root@rhel7_node1 ~]# systemctl status systemd-journald.service
● systemd-journald.service - Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
Active: active (running) since Mon 2020-03-09 19:10:55 CST; 53min ago
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 3353 (systemd-journal)
Status: "Processing requests..."
Tasks: 1
CGroup: /system.slice/systemd-journald.service
└─3353 /usr/lib/systemd/systemd-journald
Mar 09 19:10:55 rhel7_node1.westos.com systemd-journal[3353]: Runtime journal…).
Mar 09 19:10:55 rhel7_node1.westos.com systemd-journal[3353]: Journal started
Hint: Some lines were ellipsized, use -l to show in full.
所提供的命令是journalctl
默认日志存放路径:/run/log(每次重启系统会对日志进行清空)
[root@rhel7_node1 ~]# cd /run/log
[root@rhel7_node1 log]# ls
journal
[root@rhel7_node1 log]# bootctl
System:
Machine ID: 4f72081b06bf47e99ea36241be61e2e4 #机器码,显示当前机器的日志
Boot ID: 15a33520fcfe40d48709fc6faa55a7ba
No suitable data is provided by the boot manager. See:
http://www.freedesktop.org/wiki/Software/systemd/BootLoaderInterface
http://www.freedesktop.org/wiki/Specifications/BootLoaderSpec
for details.
[root@rhel7_node1 journal]# ls
4f72081b06bf47e99ea36241be61e2e4
实验步骤(journalctl命令的用法)
-
journalctl
-n 3(日志的最新3条)[root@rhel7_node1 journal]# systemctl restart sshd [root@rhel7_node1 journal]# journalctl -n 3 -- Logs begin at Mon 2020-03-09 19:09:58 CST, end at Mon 2020-03-09 20:12:01 CST. -- Mar 09 20:12:00 rhel7_node1.westos.com sshd[10817]: Server listening on :: port 22. Mar 09 20:12:01 rhel7_node1.westos.com polkitd[7090]: Unregistered Authentication Agent for unix-pr Mar 09 20:12:00 rhel7_node1.westos.com systemd[1]: Started OpenSSH server daemon.
–since “2020-02-13 17:00”(显示17:00后的日志)
[root@rhel7_node1 ~]# journalctl --since "2020-03-10 16:25" -- Logs begin at Tue 2020-03-10 16:22:32 CST, end at Tue 2020-03-10 16:30:01 CST. -- Mar 10 16:25:24 rhel7_node1.westos.com gnome-shell[9919]: JS WARNING: [resource:///org/gnome/shell/ Mar 10 16:25:24 rhel7_node1.westos.com gnome-shell[9919]: JS WARNING: [resource:///org/gnome/shell/ Mar 10 16:25:26 rhel7_node1.westos.com dbus[7066]: [system] Activating via systemd: service name='n ...
–until"2020-02-13 17:00"(显示日志到17:00)
[root@rhel7_node1 ~]# journalctl --until "2020-03-10 16:22:33" -- Logs begin at Tue 2020-03-10 16:22:32 CST, end at Tue 2020-03-10 16:31:28 CST. -- Mar 10 16:22:32 localhost.localdomain systemd-journal[85]: Runtime journal is using 8.0M (max allow Mar 10 16:22:32 localhost.localdomain kernel: Initializing cgroup subsys cpuset Mar 10 16:22:32 localhost.localdomain kernel: Initializing cgroup subsys cpu Mar 10 16:22:32 localhost.localdomain kernel: Initializing cgroup subsys cpuacct ...
-o(设置日志的显示方式)
short(经典模式显示日志)[root@rhel7_node1 ~]# journalctl -o short -- Logs begin at Tue 2020-03-10 16: