journalctl日志工具使用方法-阿里云开发者社区

journalctl工具是在centos7之后出现的工具。

在Systemd出现之前，Linux系统及各应用的日志都是分别管理的，Systemd开始统一管理了所有Unit的启动日志，这样带来的好处就是可以只用一个 journalctl命令，查看所有日志（内核日志和应用日志）。

日志的配置文件/etc/systemd/journald.conf

参数：

-b 查看本次启动的所有日志或者什么也不加，journalctl

[root@vrgv ~]# journalctl -b
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Feb 18 10:37:48 vrgv systemd-journal[197]: Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free
Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408
Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 
Feb 18 10:37:48 vrgv kernel: Disabled fast string operations
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'

-k 查看内核日志

[root@vrgv ~]# journalctl -k
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408
Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 
Feb 18 10:37:48 vrgv kernel: Disabled fast string operations
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

-u 根据类型查询，如查看docker服务日志journalctl -u docker

[root@vrgv ~]# journalctl -u docker.service
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Feb 18 10:37:59 vrgv systemd[1]: Starting Docker Application Container Engine...
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.798907622+08:00" level=info msg="libcontainerd: started 
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.801937970+08:00" level=info msg="parsed scheme: \"unix\"
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.802051497+08:00" level=info msg="scheme \"unix\" not reg
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.806551815+08:00" level=info msg="ccResolverWrapper: send
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.806638857+08:00" level=info msg="ClientConn switching ba
Feb 18 10:37:59 vrgv dockerd[10179]: time="2021-02-18T10:37:59.808453873+08:00" l

–since “2017-01-10” --until “2017-01-11 03:00” 查看2017.1.10到2017.1.11 3点的日志，也可简写成-S和-U

[root@vrgv ~]# journalctl -S "2021-03-01 11:00" -U "2021-03-01 12:00"
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Mar 01 11:00:13 vrgv systemd[1]: Starting Cleanup of Temporary Directories...
Mar 01 11:00:13 vrgv systemd[1]: Started Cleanup of Temporary Directories.
Mar 01 11:01:01 vrgv systemd[1]: Started Session 307 of user root.
Mar 01 11:01:01 vrgv CROND[129463]: (root) CMD (run-parts /etc/cron.hourly)
Mar 01 11:01:01 vrgv run-parts(/etc/cron.hourly)[129466]: starting 0anacron

_UID 查看某个用户的日志，如查看postgres用户日志journalctl _UID=1000 (1000是根据命令id -u postgres得到的)

[root@vrgv ~]# id -u postgres
1000
[root@vrgv ~]# journalctl _UID=1000
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.254 EST [10206] LOG:  listening on IPv4 address "0.0.0.0", port
Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.254 EST [10206] LOG:  listening on IPv6 address "::", port 5432
Feb 18 10:37:59 vrgv pg_ctl[10180]: 2021-02-17 21:37:59.264 EST [10206] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5
Feb 18 10:38:00 vrgv pg_ctl[10180]: 2021-02-17 21:38:00.083 EST [10206] LOG:  redirecting log output to l

-p 显示特定优先级的信息，从而过滤掉优先级较低的信息

    0: emerg       紧急
    1: alert       警惕
    2: crit        警示
    3: err         错误
    4: warning     警告
    5: notice      注意，通告
    6: info        信息
    7: debug       调试
[root@vrgv ~]# journalctl -p 3 -b
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 12:46:08 CST. --
Feb 18 10:37:50 vrgv kernel: sd 2:0:0:0: [sda] Assuming drive cache: write through
Feb 18 10:37:50 vrgv kernel: sd 2:0:1:0: [sdb] Assuming drive cache: write through
Feb 18 10:37:50 vrgv kernel: sd 2:0:2:0: [sdc] Assuming drive cache: write through
Feb 18 10:37:51 vrgv systemd-udevd[5107]: unknown key 'PHYSDEVBUS' in /etc/udev/rules.d/80-hasp.rules:9
Feb 18 10:37:51 vrgv systemd-udevd[5107]: invalid rule '/etc/udev/rules.d/80-hasp.rules:9'
Feb 18 10:37:51 vrgv systemd-udevd[5107]: unknown key 'PHYSDEVBUS' in /etc/udev/rules.d/80-hasp.rules:10
Feb 18 10:37:51 vrgv systemd-udevd[5107]: invalid rule '/etc/udev/rules.d/80-hasp.rules:10'
Feb 18 10:37:52 vrgv kernel: piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!

-a 与-p相反，-a代表全部显示

[root@vrgv ~]# journalctl -a
-- Logs begin at Thu 2021-02-18 10:37:48 CST, end at Mon 2021-03-01 13:01:01 CST. --
Feb 18 10:37:48 vrgv systemd-journal[197]: Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free
Feb 18 10:37:48 vrgv kernel: Linux version 5.4.91-1.el7.elrepo.x86_64 (mockbuild@Build64R7) (gcc version 9.3.1 20200408
Feb 18 10:37:48 vrgv kernel: Command line: BOOT_IMAGE=/vmlinuz-5.4.91-1.el7.elrepo.x86_64 root=/dev/mapper/centos-root 
Feb 18 10:37:48 vrgv kernel: Disabled fast string operations
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Feb 18 10:37:48 vrgv kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

-o 指定日志输出格式，最为常见的格式：-o json-pretty

cat: 只显示信息字段本身。
export: 适合传输或备份的二进制格式。
json: 标准JSON，每行一个条目。
json-pretty: JSON格式，适合人类阅读习惯。
json-sse: JSON格式，经过打包以兼容server-sent事件。
short: 默认syslog类输出格式。
short-iso: 默认格式，强调显示ISO 8601挂钟时间戳。
short-monotonic: 默认格式，提供普通时间戳。
short-precise: 默认格式，提供微秒级精度。
verbose: 显示该条目的全部可用journal字段，包括通常被内部隐藏的字段。
[root@vrgv ~]# journalctl -o json-pretty -b
{
        "__CURSOR" : "s=fb03d2b00f8e4804ae90d1272f9ac3f2;i=1;b=66afbb5671e04f30b082eed2c2ff5402;m=23a7fc;t=5bb9338a8743e;x=acbe13f9
        "__REALTIME_TIMESTAMP" : "1613615868703806",
        "__MONOTONIC_TIMESTAMP" : "2336764",
        "_BOOT_ID" : "66afbb5671e04f30b082eed2c2ff5402",
        "PRIORITY" : "6",
        "_TRANSPORT" : "driver",
        "MESSAGE" : "Runtime journal is using 8.0M (max allowed 799.4M, trying to leave 1.1G free of 7.7G available \uffffffe2\ufff
        "MESSAGE_ID" : "ec387f577b844b8fa948f33cad9a75e6",
        "_PID" : "197",
        "_UID" : "0",
        "_GID" : "0",
        "_COMM" : "systemd-journal",
        "_EXE" : "/usr/lib/systemd/systemd-journald",
        "_CMDLINE" : "/usr/lib/systemd/systemd-journald",
        "_CAP_EFFECTIVE" : "25402800cf",
        "_SYSTEMD_CGROUP" : "/system.slice/systemd-journald.service",
        "_SYSTEMD_UNIT" : "systemd-journald.service",
        "_SYSTEMD_SLICE" : "system.slice",
        "_MACHINE_ID" : "92dcecad2935477796367be725a6735b",
        "_HOSTNAME" : "vrgv"
}

-f 持续实时输入日志

[root@vrgv ~]# journalctl -fu docker.service
-- Logs begin at Thu 2021-02-18 10:37:48 CST. --
Feb 18 10:38:00 vrgv dockerd[10179]: time="2021-02-18T10:38:00.241741884+08:00" level=info msg="Loading containers: start."
Feb 18 10:38:01 vrgv dockerd[10179]: time="2021-02-18T10:38:01.610646278+08:00" level=info msg="Default bridge (docker0) is assigned with an IP address 172.17.0.0/16. Daemon option --bip can be used to set a preferred IP address"
Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.143827293+08:00" level=info msg="Loading containers: done."
Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.250503801+08:00" level=info msg="Docker daemon" commit=481bc77 graphdriver(s)=overlay2 version=18.09.6
Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.250847585+08:00" level=info msg="Daemon has completed initialization"
Feb 18 10:38:02 vrgv dockerd[10179]: time="2021-02-18T10:38:02.277582884+08:00" level=info msg="API listen on /var/run/docker.sock"
Feb 18 10:38:02 vrgv systemd[1]: Started Docker Application Container Engine.

另外几种查看信息的

查看日志占用磁盘空间大小

[root@k8s-node1 ~]# journalctl --disk-usage 
Archived and active journals take up 87.6M on disk.

设置日志占用磁盘空间

[root@k8s-node1 ~]# journalctl --vacuum-size=500M
Vacuuming done, freed 0B of archived journals on disk.

设置日志最长保留时间

month/years

[root@k8s-node1 ~]# journalctl --vacuum-time=1month
Vacuuming done, freed 0B of archived journals on disk.

最后看一下配置文件

[root@k8s-node1 ~]# vim /etc/systemd/journald.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See journald.conf(5) for details.
[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitInterval=30s
#RateLimitBurst=1000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

journalctl日志工具使用方法

热门文章

最新文章

相关课程

相关电子书

相关实验场景

热门

活动广场

任务中心

开发者评测

高校计划

乘风者计划

训练营

阿里云MVP

话题

直播

下载

镜像站

技术资料