journalctl命令 – 查看指定的日志信息
journalctl命令来自英文词组“journal control”的缩写，其功能是用于查看指定的日志信息。在RHEL7/CentOS7及以后版本的Linux系统中，Systemd服务统一管理了所有服务的启动日志，带来的好处就是可以只用journalctl一个命令，查看到全部的日志信息了。
语法格式：journalctl [参数] [对象]
常用参数：
| -a | 显示所有字段信息 |
| -b | 显示本次系统启动x日志 |
| -c | 从指定位置开始显示条目 |
| -D | 设置目录路径 |
| -f | 追踪日志内容 |
| -k | 显示内核日志 |
| -m | 显示所有可用日志 |
| -n | 设置日志条数 |
| -o | 设置日志条目格式 |
| -p | 依据优先级筛选 |
| -q | 静默执行模式 |
| -r | 反选内容后再显示 |
| -u | 显示指定服务的日志 |
| --help | 显示帮助信息 |
| --version | 显示版本信息 |
参考示例
查看系统中全部的日志信息：
[root@linux-arae-cc ~]# journalctl
-- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>
May 18 02:12:18 linuxprobe.com kernel: Linux version 4.18.0-80.el8.x86_64 (mock>
May 18 02:12:18 linuxprobe.com kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vm>
May 18 02:12:18 linuxprobe.com kernel: Disabled fast string operations
………………省略部分输出信息………………指定查看内核日志信息：
[root@linux-arae-cc ~]# journalctl -k
-- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>
May 18 02:12:18 linuxprobe.com kernel: Linux version 4.18.0-80.el8.x86_64 (mock>
May 18 02:12:18 linuxprobe.com kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vm>
May 18 02:12:18 linuxprobe.com kernel: Disabled fast string operations
………………省略部分输出信息………………指定查看本次系统启动的日志信息：
[root@linux-arae-cc ~]# journalctl -b
-- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>
May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x001:>
May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x002:>
May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x004:>
………………省略部分输出信息………………指定查看某个服务程序的日志信息：
[root@linux-arae-cc ~]# journalctl -u sshd
-- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:17:01 CS>
May 18 02:12:22 linux.arae.cc systemd[1]: Starting OpenSSH server daemon...
May 18 02:12:22 linux.arae.cc sshd[1109]: Server listening on 0.0.0.0 port 22.
May 18 02:12:22 linux.arae.cc sshd[1109]: Server listening on :: port 22.
May 18 02:12:22 linux.arae.cc systemd[1]: Started OpenSSH server daemon.
………………省略部分输出信息………………指定查看最近10条日志信息：
[root@linux-arae-cc ~]# journalctl -n 10
-- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:17:01 CS>
May 28 13:01:01 linux.arae.cc run-parts[3541]: (/etc/cron.hourly) finished 0ana>
May 28 13:15:00 linux.arae.cc dbus-daemon[980]: [system] Activating via systemd>
May 28 13:15:00 linux.arae.cc systemd[1]: Starting Fingerprint Authentication D>
May 28 13:15:00 linux.arae.cc dbus-daemon[980]: [system] Successfully activated>
May 28 13:15:00 linux.arae.cc systemd[1]: Started Fingerprint Authentication Da>
May 28 13:15:02 linux.arae.cc gdm-password][3666]: gkr-pam: unlocked login keyr>
May 28 13:15:02 linux.arae.cc NetworkManager[1093]: <info> [1653714902.2810] a>
May 28 13:17:01 linux.arae.cc anacron[2921]: Job `cron.monthly' started
May 28 13:17:01 linux.arae.cc anacron[2921]: Job `cron.monthly' terminated
May 28 13:17:01 linux.arae.cc anacron[2921]: Normal exit (3 jobs run)持续追踪最新的日志信息，保持刷新内容：
[root@linux-arae-cc ~]# journalctl -f
-- Logs begin at Thu 2023-05-18 02:12:18 CST. --
May 28 13:01:01 linux.arae.cc run-parts[3541]: (/etc/cron.hourly) finished 0anacron
May 28 13:15:00 linux.arae.cc dbus-daemon[980]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service' requested by ':1.177' (uid=0 pid=2222 comm="/usr/bin/gnome-shell " label="unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023")
May 28 13:15:00 linux.arae.cc systemd[1]: Starting Fingerprint Authentication Daemon...
May 28 13:15:00 linux.arae.cc dbus-daemon[980]: [system] Successfully activated service 'net.reactivated.Fprint'
May 28 13:15:00 linux.arae.cc systemd[1]: Started Fingerprint Authentication Daemon.
May 28 13:15:02 linux.arae.cc gdm-password][3666]: gkr-pam: unlocked login keyring
May 28 13:15:02 linux.arae.cc NetworkManager[1093]: <info> [1653714902.2810] agent-manager: req[0x7fdcc8007190, :1.177/org.gnome.Shell.NetworkAgent/0]: agent registered
May 28 13:17:01 linux.arae.cc anacron[2921]: Job `cron.monthly' started
May 28 13:17:01 linux.arae.cc anacron[2921]: Job `cron.monthly' terminated
May 28 13:17:01 linux.arae.cc anacron[2921]: Normal exit (3 jobs run)
………………省略部分输出信息………………