sytemd 日志 journal

参考

使用journal查看Systemd日志

journalctl [OPTIONS...] [MATCHES...]

Query the journal.

Flags:
     --system              Show the system journal
     --user                Show the user journal for the current user
  -M --machine=CONTAINER   Operate on local container
  -S --since=DATE          Show entries not older than the specified date
  -U --until=DATE          Show entries not newer than the specified date
  -c --cursor=CURSOR       Show entries starting at the specified cursor
     --after-cursor=CURSOR Show entries after the specified cursor
     --show-cursor         Print the cursor after all the entries
  -b --boot[=ID]           Show current boot or the specified boot
     --list-boots          Show terse information about recorded boots
  -k --dmesg               Show kernel message log from the current boot
  -u --unit=UNIT           Show logs from the specified unit
  -t --identifier=STRING   Show entries with the specified syslog identifier
  -p --priority=RANGE      Show entries with the specified priority
  -e --pager-end           Immediately jump to the end in the pager
  -f --follow              Follow the journal
  -n --lines[=INTEGER]     Number of journal entries to show
     --no-tail             Show all lines, even in follow mode
  -r --reverse             Show the newest entries first
  -o --output=STRING       Change journal output mode (short, short-iso,
                                   short-precise, short-monotonic, verbose,
                                   export, json, json-pretty, json-sse, cat)
     --utc                 Express time in Coordinated Universal Time (UTC)
  -x --catalog             Add message explanations where available
     --no-full             Ellipsize fields
  -a --all                 Show all fields, including long and unprintable
  -q --quiet               Do not show privilege warning
     --no-pager            Do not pipe output into a pager
  -m --merge               Show entries from all available journals
  -D --directory=PATH      Show journal files from directory
     --file=PATH           Show journal file
     --root=ROOT           Operate on catalog files underneath the root ROOT
     --interval=TIME       Time interval for changing the FSS sealing key
     --verify-key=KEY      Specify FSS verification key
     --force               Override of the FSS key pair with --setup-keys

Commands:
  -h --help                Show this help text
     --version             Show package version
  -F --field=FIELD         List all values that a specified field takes
     --new-id128           Generate a new 128-bit ID
     --disk-usage          Show total disk usage of all journal files
     --vacuum-size=BYTES   Reduce disk usage below specified size
     --vacuum-time=TIME    Remove journal files older than specified date
     --flush               Flush all journal data from /run into /var
     --header              Show journal header information
     --list-catalog        Show all message IDs in the catalog
     --dump-catalog        Show entries in the message catalog
     --update-catalog      Update the message catalog database
     --setup-keys          Generate a new FSS key pair
     --verify              Verify journal file consistency

journal 的 配置文件

/etc/systemd/journald.conf

[Journal]
#日志存储到磁盘 persistent
#Storage=auto
#压缩日志
#Compress=yes
#为日志添加序列号
#Seal=yes
#每个用户分别记录日志
#SplitMode=uid
#日志同步到磁盘的间隔，高级别的日志，如：CRIT、ALERT、EMERG 三种总是实时同步
#SyncIntervalSec=5m

#即制日志的最大流量，此处指 30s 内最多记录 100000 条日志，超出的将被丢弃
#RateLimitInterval=30s
#与 RateLimitInterval 配合使用
#RateLimitBurst=1000

#限制全部日志文件加在一起最多可以占用多少空间，默认值是10%空间与4G空间两者中的较小者
#SystemMaxUse=
#默认值是15%空间与4G空间两者中的较大者
#SystemKeepFree=
#单个日志文件的大小限制，超过此限制将触发滚动保存
#SystemMaxFileSize=

#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=

#日志最大保留时间，超过时限的旧日志将被删除 100year
#MaxRetentionSec=
#日志滚动的最大时间间隔，若不设置则完全以大小限制为准
#MaxFileSec=1month

#是否转发符合条件的日志记录到本机的其它日志管理系统，如：rsyslog
#ForwardToSyslog=yes
#ForwardToKMsg=no
#是否转发符合条件的日志到所有登陆用户的终端
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

##重启journald

systemctl restart systemd-journald

转载于:https://my.oschina.net/u/3350266/blog/3016905