linux-journal日志文件特别大怎么办，journal日志文件学习

今天发现磁盘容量不多了，就去清理磁盘，发现这个文件特别大：journal，特此来学习下

root@main1:/var/log# du -sh * | sort -rh
3.9G	journal
14M	syslog.1
2.6M	auth.log
1.7M	syslog
1.4M	nginx
1.2M	auth.log.1
972K	cloud-init.log
784K	btmp
756K	syslog.5.gz
752K	syslog.4.gz
752K	syslog.3.gz

查看日志

# 查看所有日志（默认情况下只保存本次启动的日志）
$ sudo journalctl

# 显示尾部指定行数的日志，默认10行
$ sudo journalctl -n 20

# 实时滚动显示最新日志
$ sudo journalctl -f

# 查看指定时间的日志
$ sudo journalctl --since yesterday
$ sudo journalctl --since="2023-12-22 16:52:18"
$ sudo journalctl --since "30 min ago"
$ sudo journalctl --since "2023-12-22 16:52:18" --until "2023-12-22 23:52:18"
$ sudo journalctl --since 09:00 --until "1 hour ago"

# 查看内核日志，过滤掉应用日志
$ sudo journalctl -k

# 查看系统本次启动的日志
$ sudo journalctl -b
$ sudo journalctl -b -0

# 查看上一次启动的日志
$ sudo journalctl -b -1

# 查看指定优先级及其以上级别的日志，共有8级 0: emerg 1: alert 2: crit 3: err 4: warning 5: notice 6: info 7: debug
# -b 不加任何参数时，表示显示当前引导周期的日志。这意味着只显示自最近一次启动以来的日志。
# -b N： N 是一个整数，表示要显示第 N 个引导周期的日志。例如，-b 0 表示显示最新的引导周期，-b 1 表示显示上一个引导周期，以此类推
$ sudo journalctl -p err -b

# 日志默认分页输出，--no-pager 改为正常的标准输出
$ sudo journalctl --no-pager

# 以单行 JSON 格式输出
$ sudo journalctl -b -u nginx.service -o json

# 以多行 JSON 可读性更好的格式输出
$ sudo journalctl -b -u nginx.service  -o json-pretty

查看指定服务日志

# 查看指定服务的日志
$ sudo journalctl /usr/sbin/sshd

# 查看指定进程的日志
$ sudo journalctl _PID=1

# 查看某个路径的脚本的日志
$ sudo journalctl /bin/bash

# 查看指定用户的日志
$ sudo journalctl _UID=1000 --since today

# 查看某个 Unit 的日志
# 单元（unit）通常是 systemd 服务的一个抽象，用于表示系统中正在运行的各种服务或任务
$ sudo journalctl -u nginx.service
$ sudo journalctl -u nginx.service --since today

# 合并显示多个 Unit 的日志
$ journalctl -u nginx.service -u ssh.service --since today

查看调整存储

# 显示日志占据的硬盘空间
$ sudo journalctl --disk-usage

# 仅保留500MB大小的日志文件
$ sudo journalctl --vacuum-size=500M

# 指定日志文件保存多久
$ sudo journalctl --vacuum-time=1years

# 仅保留最近一个月的日志文件
$ sudo journalctl --vacuum-time=1m

# 仅保留最近2天的日志文件
$ sudo journalctl --vacuum-time=2d

那我就用这个命令设置下：

sudo journalctl --vacuum-size=500M

root@main1:/var/log# sudo journalctl --vacuum-size=500M
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000051cc5d-00061339453d0178.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000053cc12-0006135b3f1eef94.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000055c9c2-0006137b543284b3.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000057c7bc-0006139bf5d2dfb3.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000059c637-000613bd9b2a1255.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005bc5cc-000613e093e093a9.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005dc475-0006140224bbf06b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005fc2eb-0006142376145477.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000061c0ab-00061443ee4e321d.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000063b8a4-00061462d01f6943.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000065b60f-0006148311b86d49.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000067b5d8-000614a527ea10fb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000069b5a3-000614c6ed919071.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006bad29-000614e5bde0dd56.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006daae6-00061505c78cc43b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006fa8d6-0006152782bf9c19.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000071a87b-0006154957068898.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000073a822-0006156b5640dafb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000075a7ec-0006158d5e6e7836.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000077a7b5-000615afc5a2ce3d.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000079a777-000615d2298f4e78.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007b9eca-000615f1e374d03b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007d9e6d-00061615581b86c0.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007f9bc9-0006163643e9ddcb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000819c06-0006165858845fce.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000839bba-0006167a9ee9be99.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000859afe-0006169d0a9a36ec.journal (128.0M).
Vacuuming done, freed 3.3G of archived journals from /var/log/journal/20200717161206652139342161693131.
Vacuuming done, freed 0B of archived journals from /var/log/journal.
root@main1:/var/log# du -sh * | sort -rh
497M	journal
14M	syslog.1
2.6M	auth.log
1.7M	syslog
1.4M	nginx
1.2M	auth.log.1
972K	cloud-init.log
784K	btmp
756K	syslog.5.gz
752K	syslog.4.gz
752K	syslog.3.gz
752K	syslog.2.gz
748K	syslog.6.gz
744K	syslog.7.gz

竟然自动清理了