[root@WWW ~]# journalctl # 什么参数也不加, 直接执行 -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:01:01 EDT. -- Sep 06 00:09:06 localhost.localdomain systemd-journal[89]: Runtime journal is using 8.0M (max allowed 91.9M, trying to leave 137.9M free of 911.7M available → current limi Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpuset Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpu Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpuacct Sep 06 00:09:06 localhost.localdomain kernel: Linux version 3.10.0-514.21.2.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GC Sep 06 00:09:06 localhost.localdomain kernel: Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.21.2.el7.x86_64 root=/dev/mapper/cl-root ro crashkernel=auto rd.lvm.lv=cl/root r ...(omitted) # 从这次开机以来的所有记录, 量非常大 [root@WWW ~]# journalctl --since today # 从今天开始的所有记录, 由于我刚开的机, 所以和上面一样 -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:01:01 EDT. -- Sep 06 00:09:06 localhost.localdomain systemd-journal[89]: Runtime journal is using 8.0M (max allowed 91.9M, trying to leave 137.9M free of 911.7M available → current limi Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpuset Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpu Sep 06 00:09:06 localhost.localdomain kernel: Initializing cgroup subsys cpuacct Sep 06 00:09:06 localhost.localdomain kernel: Linux version 3.10.0-514.21.2.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GC Sep 06 00:09:06 localhost.localdomain kernel: Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.21.2.el7.x86_64 root=/dev/mapper/cl-root ro crashkernel=auto rd.lvm.lv=cl/root r ...(omitted) # 既然有了since, 自然就有until, 其实这两个可以直接写成-S和-U, 如果是昨天的话, 也可以直接使用yesterday [root@WWW ~]# journalctl --since "2017-09-06 00:00:00" --until "2017-09-07 00:00:00" ...(omitted) # 方便的是, 我们可以直接指定查看哪一个的UNIT的日志, 使用-u或者--unit, 比如: [root@WWW ~]# journalctl -u rsyslog -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:26:47 EDT. -- Sep 06 00:09:34 WWW systemd[1]: Starting System Logging Service... Sep 06 00:09:34 WWW systemd[1]: Started System Logging Service. # 如果有的时候输出太多了, 或者我只想查看部分怎么办呢, 有-n参数帮你解决 [root@WWW ~]# journalctl -n 10 [root@WWW ~]# journalctl -n 5 -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:26:47 EDT. -- Sep 06 01:26:47 WWW NetworkManager[742]: <info> [1504675607.0186] dhcp4 (enp0s3): state changed bound -> bound Sep 06 01:26:47 WWW dbus[593]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service' Sep 06 01:26:47 WWW systemd[1]: Starting Network Manager Script Dispatcher Service... Sep 06 01:26:47 WWW dbus-daemon[593]: dbus[593]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.ser Sep 06 01:26:47 WWW dhclient[845]: bound to 192.168.56.101 -- renewal in 584 seconds. lines 1-6/6 (END) # 这样就可以仅仅查看部分, 节选的日志 # 另外, 还可以直接指定PID/UID.~ [root@WWW ~]# journalctl _PID=`pidof crond` -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:36:31 EDT. -- Sep 06 00:09:22 WWW crond[614]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 88% if used.) Sep 06 00:09:22 WWW crond[614]: (CRON) INFO (running with inotify support) # 还可以只查看相对应等级的日志 [root@WWW ~]# journalctl -p err -- Logs begin at Wed 2017-09-06 00:09:06 EDT, end at Wed 2017-09-06 01:36:31 EDT. -- Sep 06 00:09:19 WWW kernel: intel_rapl: no valid rapl domains found in package 0 Sep 06 00:09:27 WWW systemd[1]: Failed to start vboxadd.service. Sep 06 00:09:27 WWW systemd[1]: Failed to start vboxadd-service.service. Sep 06 00:09:35 WWW postfix/sendmail[1437]: fatal: parameter inet_interfaces: no local interface found for ::1 Sep 06 00:09:35 WWW postfix[1450]: fatal: parameter inet_interfaces: no local interface found for ::1 Sep 06 00:09:36 WWW systemd[1]: Failed to start Postfix Mail Transport Agent. # 最后说两个常用的参数, -r和-f # -r就是reverse的意思啦, 最近时间的日志先输出 # -f就是follow的意思, 和tail -f的-f是一样的效果了
rsyslog
rsyslog其实一个升级版的syslog, 它支持更多特性, 例如:
多线程
SSL, TLS, UDP, TCP
MySQL, PGSQl, Oracle实现日志存储
过滤器, 实现过滤日志中的任意部分
自定义输出格式
这些介绍在其RPM包的介绍中也有:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
[root@localhost ~]# rpm -qi rsyslog Name : rsyslog Relocations: (not relocatable) Version : 4.6.2 Vendor: CentOS Release : 12.el6 Build Date: Thu 08 Dec 2011 05:40:21 AM CST Install Date: Fri 16 Dec 2011 01:49:45 PM CST Build Host: c6b4.bsys.dev.centos.org Group : System Environment/Daemons Source RPM: rsyslog-4.6.2-12.el6.src.rpm Size : 1560043 License: GPLv3+ Signature : RSA/SHA1, Fri 09 Dec 2011 05:07:22 AM CST, Key ID 0946fca2c105b9de Packager : CentOS BuildSystem <http://bugs.centos.org> URL : http://www.rsyslog.com/ Summary : Enhanced system logging and kernel message trapping daemons Description : Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is compatible with stock sysklogd and can be used as a drop-in replacement. Rsyslog is simple to set up, with advanced features suitable for enterprise-class, encryption-protected syslog relay chains.
rotating pattern: /var/log/chrony/*.log weekly (4 rotations) empty log files are rotated, old logs are removed considering log /var/log/chrony/*.log log /var/log/chrony/*.log does not exist -- skipping not running postrotate script, since no logs were rotated
...(omitted) rotating pattern: /var/log/wtmp monthly (1 rotations) empty log files are rotated, only log files >= 1048576 bytes are rotated, old logs are removed considering log /var/log/wtmp log does not need rotating (log has been already rotated) rotating pattern: /var/log/btmp monthly (1 rotations) empty log files are rotated, old logs are removed considering log /var/log/btmp log does not need rotating (log has been already rotated)
[root@WWW ~]# mysql -u root -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 12 Server version: 5.5.56-MariaDB MariaDB Server
Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MariaDB [(none)]> MariaDB [(none)]> MariaDB [(none)]> grant all on Syslog.* to 'syslog'@'192.168.56.%' identified by 'syslogpasswd'; Query OK, 0 rows affected (0.00 sec)
