journalctl---查看systemd所有日志（内核日志和应用日志）

日志的配置文件是/etc/systemd/journald.conf

[root@k8s-node1 kubernetes]# journalctl --help
journalctl [OPTIONS...] [MATCHES...]

Query the journal.

Flags:
     --system              Show the system journal
     --user                Show the user journal for the current user
  -M --machine=CONTAINER   Operate on local container
  -S --since=DATE          Show entries not older than the specified date
  -U --until=DATE          Show entries not newer than the specified date
  -c --cursor=CURSOR       Show entries starting at the specified cursor
     --after-cursor=CURSOR Show entries after the specified cursor
     --show-cursor         Print the cursor after all the entries
  -b --boot[=ID]           Show current boot or the specified boot
     --list-boots          Show terse information about recorded boots
  -k --dmesg               Show kernel message log from the current boot
  -u --unit=UNIT           Show logs from the specified unit
  -t --identifier=STRING   Show entries with the specified syslog identifier
  -p --priority=RANGE      Show entries with the specified priority
  -e --pager-end           Immediately jump to the end in the pager
  -f --follow              Follow the journal
  -n --lines[=INTEGER]     Number of journal entries to show
     --no-tail             Show all lines, even in follow mode
  -r --reverse             Show the newest entries first
  -o --output=STRING       Change journal output mode (short, short-iso,
                                   short-precise, short-monotonic, verbose,
                                   export, json, json-pretty, json-sse, cat)
     --utc                 Express time in Coordinated Universal Time (UTC)
  -x --catalog             Add message explanations where available
     --no-full             Ellipsize fields
  -a --all                 Show all fields, including long and unprintable
  -q --quiet               Do not show privilege warning
     --no-pager            Do not pipe output into a pager
  -m --merge               Show entries from all available journals
  -D --directory=PATH      Show journal files from directory
     --file=PATH           Show journal file
     --root=ROOT           Operate on catalog files underneath the root ROOT
     --interval=TIME       Time interval for changing the FSS sealing key
     --verify-key=KEY      Specify FSS verification key
     --force               Override of the FSS key pair with --setup-keys

Commands:
  -h --help                Show this help text
     --version             Show package version
  -F --field=FIELD         List all values that a specified field takes
     --new-id128           Generate a new 128-bit ID
     --disk-usage          Show total disk usage of all journal files
     --vacuum-size=BYTES   Reduce disk usage below specified size
     --vacuum-time=TIME    Remove journal files older than specified date
     --flush               Flush all journal data from /run into /var
     --header              Show journal header information
     --list-catalog        Show all message IDs in the catalog
     --dump-catalog        Show entries in the message catalog
     --update-catalog      Update the message catalog database
     --setup-keys          Generate a new FSS key pair
     --verify              Verify journal file consistency

查看所有日志（默认情况下 ，只保存本次启动的日志）

#journalctl

查看内核日志（不显示应用日志）

journalctl -k

查看系统本次启动的日志

#journalctl -b
#
#journalctl -b -0
#

查看指定时间的日志

#journalctl --since="2021-09-16 14:22:02"
#
#journalctl --since "30 min ago"
#
#journalctl --since yesterday
#
#journalctl --since "2021-01-01" --until "2021-09-16 13:40"
#
#journalctl --since 07:30 --until "2 hour ago"

显示尾部的最新10行日志

#journalctl -n

显示尾部指定行数的日志

#journalctl -n 15

实时滚动显示最新日志

#journalctl -f
#
#与tail -f类似

查看指定进程的日志

#journalctl _PID=665

查看某个路径的脚本的日志

#journalctl /usr/bin/bash

查看指定用户的日志

#journalctl UID=33 --since today

查看某个 Unit 的日志

#journalctl -u nginx.service
#journalctl -u nginx.service --since today

实时滚动显示某个 Unit 的最新日志

#journalctl -u nginx.service -f

合并显示多个 Unit 的日志

# journalctl -u nginx.service -u php-fpm.service --since today

查看指定优先级（及其以上级别）的日志，共有8级

## 0: emerg
## 1: alert
## 2: crit
## 3: err
## 4: warning
## 5: notice
## 6: info
## 7: debug

日志默认分页输出，--no-pager 改为正常的标准输出

#journalctl --no-pager

以 JSON 格式（单行）输出

#journalctl -b -u nginx.service -o json

以 JSON 格式（多行）输出，可读性更好

#journalctl -b -u nginx.serviceqq -o json-pretty

显示日志占据的硬盘空间

#journalctl --disk-usage

指定日志文件占据的最大空间，默认为8M

#journalctl --vacuum-size=1M

指定日志文件保存多久

#journalctl --vacuum-time=1years