参考资料Linux管理・運用の基本journalctlを使いこなすログ管理術【2023年1月版】 journalctl 覚えておきたい使い方メモ目录一. 简介1.1 systemd 出现之前的日志体系1.2 systemd 普及后的日志体系二. journald2.1 简介2.2 与传统syslog对比2.3 /var/log/journal/目录下的日志文件2.4 配置文件三. journalctl3.1 -f 实时查看所有的日志3.2 --boot 查看启动日志3.3 -u 查看某个服务的日志3.3.1 查看所有时间带的指定服务的日志3.3.2 实时查看指定服务的日志3.3.3 查看指定启动次数之后的指定服务的失败日志3.4 --since 与 --until 按时间查找3.5 -p err 查看错误日志3.6 查看系统日志磁盘空间占用3.7 系统日志的清理一. 简介⏹journald和journalctl是一对 后台服务 查看工具用来统一收集、存储和查看系统日志的。systemd-journald简称journald日志服务本体负责记录系统日志journalctl日志查看命令负责查看 / 查询日志1.1 systemd 出现之前的日志体系特点纯文本行为简单、透明管道清晰存在的问题日志格式不统一字段没有结构化高并发下性能一般服务启动前的日志容易丢应用程序 ↓ syslog()/ logger ↓ rsyslog / syslog-ng ↓ /var/log/*.log纯文本1.2 systemd 普及后的日志体系自2012年之后systemd开始普及日志体系如下所示应用 / 内核 / systemd ↓ systemd-journald ← 核心 ↓ ┌──────────────┐ │ 二进制日志 │ │/run /var/log │ └──────────────┘ ↓可选 rsyslog / syslog-ng ↓ 传统文本日志因为传统的syslog的生态十分庞大网络设备和安全审计规范等领域依然需要syslog所以并没有被取消。journald 不是 syslog 的替代品而是 syslog 的上游。现代 Linuxjournald 负责收syslog 负责出。systemd-journald ├─ 保存二进制日志 └─ 转发到 /run/systemd/journal/syslog ↓ rsyslog整体鸟瞰图┌───────────────────────────────┐ │ 日志产生源 │ │───────────────────────────────│ │ kernel(printk)│ │ systemd services │ │ 用户程序 / 守护进程 │ │ logger / syslog()│ └───────────────┬───────────────┘ │ ▼ ┌───────────────────────────────┐ │ systemd-journald │ ←【日志入口 / 中枢】 │───────────────────────────────│ │ • 接收所有日志 │ │ • 打时间戳 / PID /UID│ │ • 结构化存储二进制 │ │ • 自动轮转 / 限额 │ └───────────────┬───────────────┘ │ │ │ ├─────────────┐ │ │ │ ▼ ▼ ▼ ┌───────────────┐ ┌──────────────────┐ │ /run/log/ │ │ /var/log/journal │ │ journal │ │持久化 journal │ │内存 │ └──────────────────┘ └───────────────┘ │ │(ForwardToSyslogyes)▼ ┌───────────────────────────────┐ │ rsyslogd │ ←【传统兼容层 / 输出器】 │───────────────────────────────│ │ • 从 journald 读日志 │ │ • 规则过滤 / 分类 │ │ • 输出文本日志 │ │ • 网络转发 │ └───────────────┬───────────────┘ │ ▼ ┌───────────────────────────────┐ │ /var/log/*.log │ │───────────────────────────────│ │ syslog / auth.log / kern.log │ │ daemon.log / app.log... │ └───────────────┬───────────────┘ │ ▼ ┌───────────────────────────────┐ │logrotate│ ←【文本日志轮转】 │───────────────────────────────│ │ • 定期切割 │ │ • 压缩 │ │ • 删除旧日志 │ │ • 通知 rsyslog reopen │ └───────────────────────────────┘二. journald2.1 简介journald会接收来自以下来源的日志内核日志dmesgsystemd 服务日志各种系统服务ssh、cron、sudo等用户程序通过syslog/stdout/stderr输出的日志接收到日之后会存储在下面的地方/run/log/journal内存/var/log/journal磁盘特点二进制日志不是纯文本自动带上结构化信息时间戳PIDUID服务名unit可执行文件路径支持日志轮转※无需logrotate压缩按大小 / 时间自动清理2.2 与传统syslog对比对比项journald传统 syslog日志格式二进制结构化纯文本查询能力非常强按字段弱grep统一入口是否分散实时性支持支持systemd 集成原生非原生2.3/var/log/journal/目录下的日志文件*.journal文件就是journald的二进制日志数据库journalctl实际就是在读取这些文件apluserFengYeHong-HP:~$ tree /var/log/journal/ /var/log/journal/ └── 7b644cb526e843fc910b92994eacfb94 ├── system.journal ├── system00063c5b254352e2-4f53057312b77dc2.journal~ ├── system00063d0283fb5bc6-904ac48255bcb5a2.journal~ ├── system00063d04ffcd0142-2a71f4e52179981f.journal~ └── user-1000.journal1directory,5files apluserFengYeHong-HP:~$2.4 配置文件apluserFengYeHong-HP:~$ls-l/etc/systemd/journald.conf -rw-r--r--1root root1282Apr82022/etc/systemd/journald.conf下面是一份journald.conf文件的例子[Journal]# ---------- 存储方式 ----------# 持久化日志写入Storagepersistent# ---------- 空间控制重点 ----------# journal 总占用上限SystemMaxUse1G# 磁盘最少剩余空间SystemKeepFree1G# 单个文件最大大小SystemMaxFileSize100M# ---------- 时间控制 ----------# 最多保留30天的日志MaxRetentionSec30day# ---------- 写入与性能 ----------# 开启 journal 文件自动压缩, 减少日志量CompressyesSyncIntervalSec5m# 防止某个服务疯狂刷日志把磁盘写爆, 30秒内, 最多允许 10000 条, 超出的直接丢弃并记录警告RateLimitIntervalSec30sRateLimitBurst10000# ---------- 安全 ----------# 开启安全审计, journal 文件带完整性校验, 可检测日志是否被篡改Sealyes# 多用户系统, 可确保 root / 用户日志分开SplitModeuid# ---------- 其他 ----------# 保留传统日志journald → rsyslog → /var/log/*.logForwardToSyslogyes如果journald的配置文件被修改了需要通过下面的命令重启journaldsudosystemctl restart systemd-journald三. journalctljournalctl是 查看 / 查询journald日志的命令行工具3.1-f实时查看所有的日志类似于tail -fapluserubuntu24-01:~$ journalctl-fDec3015:34:46 ubuntu24-01 PackageKit[95942]: daemon start Dec3015:34:46 ubuntu24-01 dbus-daemon[885]:[system]Successfully activatedserviceorg.freedesktop.PackageKitDec3015:34:46 ubuntu24-01 systemd[1]: Started packagekit.service - PackageKit Daemon. Dec3015:35:01 ubuntu24-01 CRON[96144]: pam_unix(cron:session): session openedforuser root(uid0)by root(uid0)Dec3015:35:01 ubuntu24-01 CRON[96145]:(root)CMD(command-vdebian-sa1/dev/nulldebian-sa111)Dec3015:35:01 ubuntu24-01 CRON[96144]: pam_unix(cron:session): session closedforuser root Dec3015:35:01 ubuntu24-01 systemd[1]: apt-daily.service: Deactivated successfully. Dec3015:35:01 ubuntu24-01 systemd[1]: Finished apt-daily.service - Dailyaptdownload activities. Dec3015:35:01 ubuntu24-01 systemd[1]: apt-daily.service: Consumed19.351s CPU time.3.2--boot查看启动日志apluserubuntu24-01:~$ journalctl--boot|headAug1407:35:18 ubuntu24-01 kernel: Linux version6.8.0-71-generic(builddlcy02-amd64-053)(x86_64-linux-gnu-gcc-13(Ubuntu13.3.0-6ubuntu2~24.04)13.3.0, GNU ld(GNU BinutilsforUbuntu)2.42)#71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 (Ubuntu 6.8.0-71.71-generic 6.8.12)Aug1407:35:18 ubuntu24-01 kernel: Command line:BOOT_IMAGE/vmlinuz-6.8.0-71-genericroot/dev/mapper/ubuntu--vg-ubuntu--lv ro Aug1407:35:18 ubuntu24-01 kernel: KERNEL supported cpus: Aug1407:35:18 ubuntu24-01 kernel: Intel GenuineIntel Aug1407:35:18 ubuntu24-01 kernel: AMD AuthenticAMD Aug1407:35:18 ubuntu24-01 kernel: Hygon HygonGenuine Aug1407:35:18 ubuntu24-01 kernel: Centaur CentaurHauls Aug1407:35:18 ubuntu24-01 kernel: zhaoxin Shanghai Aug1407:35:18 ubuntu24-01 kernel: Disabled fast string operations Aug1407:35:18 ubuntu24-01 kernel: BIOS-provided physical RAM map:3.3 -u查看某个服务的日志确定服务的具体名称ssh.service⇒ssh在Ubuntu系列叫ssh在Redhat系列叫sshdapluserubuntu24-01:~$ systemctl list-units--typeservice|grepsshssh.service loaded active running OpenBSD Secure Shell server apluserubuntu24-01:~$3.3.1 查看所有时间带的指定服务的日志apluserFengYeHong-HP:~$ journalctl-ussh|headAug1420:51:11 FengYeHong-HP systemd[1]: Starting OpenBSD Secure Shell server... Aug1420:51:13 FengYeHong-HP sshd[334]: Server listening on0.0.0.0 port22. Aug1420:51:13 FengYeHong-HP sshd[334]: Server listening on :: port22. Aug1420:51:13 FengYeHong-HP systemd[1]: Started OpenBSD Secure Shell server. -- Boot 31d0ca0261ca4c60bed5ff678f5be714 -- Aug1507:53:47 FengYeHong-HP systemd[1]: Starting OpenBSD Secure Shell server... Aug1507:53:48 FengYeHong-HP sshd[277]: Server listening on0.0.0.0 port22. Aug1507:53:48 FengYeHong-HP sshd[277]: Server listening on :: port22. Aug1507:53:48 FengYeHong-HP systemd[1]: Started OpenBSD Secure Shell server. apluserFengYeHong-HP:~$3.3.2 实时查看指定服务的日志apluserubuntu22-1:~$sudojournalctl-f-ussh.service[sudo]passwordforapluser: Aug1221:37:25 ubuntu22-1 sshd[2967]: Usergitnot allowed because account is locked Aug1221:37:52 ubuntu22-1 sshd[2967]: error: Could not get shadow informationforNOUSER Aug1221:37:52 ubuntu22-1 sshd[2967]: Failed passwordforinvalid usergitfrom172.22.112.1 port4324ssh2 Aug1221:38:00 ubuntu22-1 sshd[2967]: Failed passwordforinvalid usergitfrom172.22.112.1 port4324ssh2 Aug1221:39:27 ubuntu22-1 sshd[3567]: Usergitnot allowed because account is locked Aug1221:39:56 ubuntu22-1 sshd[3567]: Connection closed by invalid usergit172.22.112.1 port4509[preauth]Aug1221:40:13 ubuntu22-1 sshd[3748]: Failed passwordforapluser from172.22.112.1 port4526ssh2 Aug1221:40:41 ubuntu22-1 sshd[3748]: Failed passwordforapluser from172.22.112.1 port4526ssh2 Aug1221:41:13 ubuntu22-1 sshd[3748]: Failed passwordforapluser from172.22.112.1 port4526ssh2 Aug1221:41:13 ubuntu22-1 sshd[3748]: Connection closed by authenticating user apluser172.22.112.1 port4526[preauth]3.3.3 查看指定启动次数之后的指定服务的失败日志--boot 0本次启动apluserubuntu24-01:~$ journalctl-ussh--boot0|grep-E-ifailed|failure|invalid|authenticationJun2222:08:19 ubuntu24-01 sshd[21644]: pam_unix(sshd:auth): authentication failure;lognameuid0euid0ttysshruserrhost192.168.137.1userapluser Jun2222:08:21 ubuntu24-01 sshd[21644]: Failed passwordforapluser from192.168.137.1 port14522ssh2 Aug1109:11:24 ubuntu24-01 sshd[98092]: pam_unix(sshd:auth): authentication failure;lognameuid0euid0ttysshruserrhost192.168.137.1userapluser Aug1109:11:26 ubuntu24-01 sshd[98092]: Failed passwordforapluser from192.168.137.1 port10734ssh2 Aug1109:11:33 ubuntu24-01 sshd[98092]: Failed passwordforapluser from192.168.137.1 port10734ssh2 Aug1109:11:38 ubuntu24-01 sshd[98092]: Failed passwordforapluser from192.168.137.1 port10734ssh2 Aug1109:11:38 ubuntu24-01 sshd[98092]: PAM2moreauthentication failures;lognameuid0euid0ttysshruserrhost192.168.137.1userapluser Aug1109:16:07 ubuntu24-01 sshd[98270]: Invalid user spluser from192.168.137.1 port10756Aug1109:16:12 ubuntu24-01 sshd[98270]: pam_unix(sshd:auth): authentication failure;lognameuid0euid0ttysshruserrhost192.168.137.1 Aug1109:16:14 ubuntu24-01 sshd[98270]: Failed passwordforinvalid user spluser from192.168.137.1 port10756ssh2 Aug1109:16:16 ubuntu24-01 sshd[98270]: Connection closed by invalid user spluser192.168.137.1 port10756[preauth]Aug1109:16:22 ubuntu24-01 sshd[98273]: Invalid user xpluser from192.168.137.1 port10782Aug1109:16:25 ubuntu24-01 sshd[98273]: pam_unix(sshd:auth): authentication failure;lognameuid0euid0ttysshruserrhost192.168.137.1 Aug1109:16:28 ubuntu24-01 sshd[98273]: Failed passwordforinvalid user xpluser from192.168.137.1 port10782ssh2 Aug1109:16:30 ubuntu24-01 sshd[98273]: Connection closed by invalid user xpluser192.168.137.1 port10782[preauth]apluserubuntu24-01:~$--boot 1上次启动--boot 2上上次启动apluserubuntu24-01:~$ journalctl-ussh--boot-1|grep-E-ifailed|failure|invalid|authenticationapluserubuntu24-01:~$ apluserubuntu24-01:~$ journalctl-ussh--boot-2|grep-E-ifailed|failure|invalid|authenticationJun1622:23:56 ubuntu24-01 sshd[1510]: pam_unix(sshd:auth): authentication failure;lognameuid0euid0ttysshruserrhost192.168.137.1userroot Jun1622:23:58 ubuntu24-01 sshd[1510]: Failed passwordforroot from192.168.137.1 port12770ssh2 Jun1622:24:10 ubuntu24-01 sshd[1510]: Failed passwordforroot from192.168.137.1 port12770ssh2 Jun1622:24:17 ubuntu24-01 sshd[1510]: Failed passwordforroot from192.168.137.1 port12770ssh2 Jun1622:24:18 ubuntu24-01 sshd[1510]: PAM2moreauthentication failures;lognameuid0euid0ttysshruserrhost192.168.137.1userroot apluserubuntu24-01:~$3.4--since与--until按时间查找--since从某个时间点开始的日志apluserubuntu24-01:~$ journalctl--since2025-12-20 10:00|headDec2010:00:31 ubuntu24-01 systemd[1]: Starting sysstat-collect.service - system activity accounting tool... Dec2010:00:31 ubuntu24-01 systemd[1]: sysstat-collect.service: Deactivated successfully. Dec2010:00:31 ubuntu24-01 systemd[1]: Finished sysstat-collect.service - system activity accounting tool. Dec2010:01:34 ubuntu24-01 systemd[1]: Starting fwupd-refresh.service - Refresh fwupd metadata and update motd... Dec2010:01:34 ubuntu24-01 systemd[1]: fwupd-refresh.service: Deactivated successfully. Dec2010:01:34 ubuntu24-01 systemd[1]: Finished fwupd-refresh.service - Refresh fwupd metadata and update motd. Dec2010:05:01 ubuntu24-01 CRON[82718]: pam_unix(cron:session): session openedforuser root(uid0)by root(uid0)Dec2010:05:01 ubuntu24-01 CRON[82719]:(root)CMD(command-vdebian-sa1/dev/nulldebian-sa111)Dec2010:05:01 ubuntu24-01 CRON[82718]: pam_unix(cron:session): session closedforuser root Dec2010:10:34 ubuntu24-01 systemd[1]: Starting sysstat-collect.service - system activity accounting tool...查看今天指定服务的日志apluserubuntu24-01:~$ journalctl-ussh--sincetoday Dec3015:34:45 ubuntu24-01 sshd[95637]: Accepted publickeyforapluser from192.168.137.1 port11122ssh2: RSA SHA256:VNI4N/2gk8hX7hf4dp1rY1cHJ23SumccXly1777Eitw Dec3015:34:45 ubuntu24-01 sshd[95637]: pam_unix(sshd:session): session openedforuser apluser(uid1000)by apluser(uid0)Dec3020:39:52 ubuntu24-01 sshd[97492]: Accepted publickeyforapluser from192.168.137.1 port7988ssh2: RSA SHA256:VNI4N/2gk8hX7hf4dp1rY1cHJ23SumccXly1777Eitw Dec3020:39:52 ubuntu24-01 sshd[97492]: pam_unix(sshd:session): session openedforuser apluser(uid1000)by apluser(uid0)Dec3020:40:42 ubuntu24-01 sshd[97614]: Accepted publickeyforapluser from192.168.137.1 port7994ssh2: RSA SHA256:VNI4N/2gk8hX7hf4dp1rY1cHJ23SumccXly1777Eitw Dec3020:40:42 ubuntu24-01 sshd[97614]: pam_unix(sshd:session): session openedforuser apluser(uid1000)by apluser(uid0)--until截止到某个时间点的日志apluserubuntu24-01:~$ journalctl--since2025-12-10 10:00--until2025-12-30 10:00|headNov3020:45:15 ubuntu24-01 systemd-networkd[72683]: ens33: Gained carrier Dec1419:45:45 ubuntu24-01 systemd-resolved[27545]: Clock change detected. Flushing caches. Dec1419:45:45 ubuntu24-01 systemd-networkd[72683]: ens33: Lost carrier Dec1419:45:45 ubuntu24-01 systemd[1]: Starting apt-daily.service - Dailyaptdownload activities... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting dpkg-db-backup.service - Daily dpkg database backup service... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting e2scrub_all.service - Online ext4 Metadata CheckforAll Filesystems... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting fstrim.service - Discard unused blocks on filesystems from /etc/fstab... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting fwupd-refresh.service - Refresh fwupd metadata and update motd... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting motd-news.service - Message of the Day... Dec1419:45:45 ubuntu24-01 systemd[1]: Starting sysstat-collect.service - system activity accounting tool...3.5-p err查看错误日志⏹日志级别如下emergalertcriterrwarningnoticeinfodebugapluserubuntu24-01:~$ journalctl-perr|headSep2522:16:07 ubuntu221 kernel: piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!Sep2522:16:30 ubuntu221 login[1303]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannotopenshared object file: No suchfileor directory Sep2522:16:30 ubuntu221 login[1303]: PAM adding faulty module: pam_lastlog.so -- Boot d2c210f3a91f485786968cd34d0d4d9f -- Sep2522:20:13 ubuntu221 kernel: piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!Sep2522:20:23 ubuntu221 login[1060]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannotopenshared object file: No suchfileor directory Sep2522:20:23 ubuntu221 login[1060]: PAM adding faulty module: pam_lastlog.so -- Boot fe4732dd1ba34132b12361fea4fa0ad2 -- Sep2522:21:03 ubuntu221 kernel: piix4_smbus 0000:00:07.3: SMBus Host Controller not enabled!Sep2522:21:24 ubuntu221 login[1197]: PAM unable to dlopen(pam_lastlog.so): /usr/lib/security/pam_lastlog.so: cannotopenshared object file: No suchfileor directory3.6 查看系统日志磁盘空间占用apluserubuntu24-01:~$ journalctl --disk-usage Archived and active journals take up257.6Minthefilesystem.3.7 系统日志的清理手动触发日志轮转sudojournalctl--rotate清理14天之前的旧日志sudojournalctl --vacuum-time14d将所有 journal 日志的【总占用空间】压缩到 ≤ 500MBjournald 会 从最旧的日志开始删除一直删除到总占用 ≤ 500Msudojournalctl --vacuum-size500M
