Linux 系统时间及系统日志

一、查看设置系统时间
（1）查看系统时间区
命令：timedatectl

经查看，系统当前时区设置为美国纽约，现将时区改为亚洲上海

(2)查看时间所有时区

[root@name2 .ssh]# timedatectl list-timezones

(3)将本机时区改为亚洲上海

[root@name2 .ssh]# timedatectl set-timezone Asia/Shanghai
[root@name2 .ssh]# timedatectl
Local time: Sun 2018-07-29 11:40:09 CST
Universal time: Sun 2018-07-29 03:40:09 UTC
RTC time: Wed 2018-10-17 06:20:07
Timezone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: no
DST active: n/a
[root@name2 .ssh]#

(4)timedatectl 可以设置时间

[root@name2 .ssh]# timedatectl set-time “2018-10-02 10:07:00”
[root@name2 .ssh]# date
Tue Oct 2 10:07:03 CST 2018
[root@name2 .ssh]#

二、系统日志
直接查看日至
1、 journalctl 查看所有日至

[root@name2 ~]# journalctl
– Logs begin at Tue 2018-10-16 21:12:12 EDT, end at Tue 2018-10-16 21:12:17 EDT
Oct 16 21:12:12 localhost systemd-journal[83]: Runtime journal is using 8.0M (ma
Oct 16 21:12:12 localhost systemd-journal[83]: Runtime journal is using 8.0M (ma
Oct 16 21:12:12 localhost kernel: Initializing cgroup subsys cpuset
Oct 16 21:12:12 localhost kernel: Initializing cgroup subsys cpu
Oct 16 21:12:12 localhost kernel: Initializing cgroup subsys cpuacct
Oct 16 21:12:12 localhost kernel: Linux version 3.10.0-123.el7.x86_64 (mockbuild
Oct 16 21:12:12 localhost kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-3.10.0-
Oct 16 21:12:12 localhost kernel: e820: BIOS-provided physical RAM map:
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x00000000000f0000-0x000000000
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x000000007fff8000-0x000000007
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000f
Oct 16 21:12:12 localhost kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000f
Oct 16 21:12:12 localhost kernel: NX (Execute Disable) protection: active
Oct 16 21:12:12 localhost kernel: SMBIOS 2.4 present.
Oct 16 21:12:12 localhost kernel: DMI: Red Hat KVM, BIOS 0.5.1 01/01/2011
Oct 16 21:12:12 localhost kernel: Hypervisor detected: KVM
Oct 16 21:12:12 localhost kernel: e820: update [mem 0x00000000-0x00000fff] usabl
Oct 16 21:12:12 localhost kernel: e820: remove [mem 0x000a0000-0x000fffff] usabl
Oct 16 21:12:12 localhost kernel: No AGP bridge found
lines 1-23

2、查看最新5条日至(q退出查看)

3、按时间查看
since–从什么时候开始
until–到什么时候结束

4、按类型查看
[root@node1 ~]# journalctl -p err ##查看错误日至

5,查看所有日至详细信息

(1)查看ssh进程

[root@name2 .ssh]# systemctl status sshd
sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: active (running) since Wed 2018-10-17 09:13:10 CST; 2 weeks 0 days left
Process: 1252 ExecStartPre=/usr/sbin/sshd-keygen (code=exited, status=0/SUCCESS)
Main PID: 1258 (sshd)
CGroup: /system.slice/sshd.service
└─1258 /usr/sbin/sshd -D
Oct 17 09:13:10 name2.example.com systemd[1]: Started OpenSSH server daemon.
Oct 17 09:13:12 name2.example.com sshd[1258]: Server listening on 0.0.0.0 port 22.
Oct 17 09:13:12 name2.example.com sshd[1258]: Server listening on :: port 22.
Oct 17 09:18:02 name2.example.com sshd[2270]: Accepted password for root from 172.25.254.68 port 36584 ssh2
[root@name2 .ssh]#

进程pid为1258
进入所有日志中按照pid查找

(2)[root@node1 ~]# journalctl -o verbose (/1258)

(3)根据查出来的信息可以有针对性的查询

[root@name2 .ssh]# journalctl _PID=1258 _COMM=sshd
– Logs begin at Wed 2018-10-17 09:12:12 CST, end at Wed 2018-10-17 09:12:17 CST. –
Oct 17 09:13:12 name2.example.com sshd[1258]: Server listening on 0.0.0.0 port 22.
Oct 17 09:13:12 name2.example.com sshd[1258]: Server listening on :: port 22.
[root@name2 .ssh]#

6、重其后日至丢失（reboot）
使用joucnal采集日志重启后日志不丢失
（1）.建立日至保存文件

[root@name2 ~]# mkdir /var/log/journal
[root@name2 ~]# ll -d /var/log/journal
drwxr-xr-x. 2 root root 6 Oct 2 10:17 /var/log/journal
[root@name2 ~]#

新建文件用户组均为root
(2).改变文件所属组

[root@name2 ~]# chgrp systemd-journal /var/log/journal
[root@name2 ~]# ll -d /var/log/journal
drwxr-xr-x. 2 root systemd-journal 6 Oct 2 10:17 /var/log/journal
[root@name2 ~]#

将用户所属组改为systemd-journal，因为只有组systemd-journal里面的用户文件才会受保护，在重启是不会丢失

（3）设置在在目录中重建文件是所属组仍然是systemd-journal

[root@name2 ~]# chmod g+s /var/log/journal/
[root@name2 ~]# ll -d /var/log/journal
drwxr-sr-x. 2 root systemd-journal 6 Oct 2 10:17 /var/log/journal
[root@name2 ~]#

(4)查看
[root@node1 ~]# ps aux |grep systemd-journald
root 371 0.0 0.2 40864 2220 ? Ss 09:47 0:00 /usr/lib/systemd/systemd-journald
root 2553 0.0 0.0 112640 940 pts/0 R+ 10:20 0:00 grep --color=auto systemd-journald
[root@node1 ~]#

(5)结束进程

[root@node1 ~]# kill -l 371
-bash: kill: 371: invalid signal specification

(6)再次查看日至是否存在（但不能使用cat查看）
只能通过journal查看

若使用ls查看，显示的是机器码

[root@name2 journal]# ls
946cb0e817ea4adb916183df8c4fc817 #机器码
[root@name2 journal]# bootctl
System:
Machine ID: 946cb0e817ea4adb916183df8c4fc817
Boot ID: f1180d81d3f94d3b8d83ee81f1523bad

journal查看，日志仍然存在