Merge pull request #28597 from Chao-zhi/patch-1

translating by Chao-zhi
This commit is contained in:
Xingyu.Wang 2023-02-10 23:21:05 +08:00 committed by GitHub
commit 175e10b45c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 260 additions and 257 deletions

View File

@ -1,257 +0,0 @@
[#]: subject: "How to use journalctl to View and Analyze Systemd Logs [With Examples]"
[#]: via: "https://www.debugpoint.com/systemd-journalctl/"
[#]: author: "Arindam https://www.debugpoint.com/author/admin1/"
[#]: collector: "lkxed"
[#]: translator: " "
[#]: reviewer: " "
[#]: publisher: " "
[#]: url: " "
How to use journalctl to View and Analyze Systemd Logs [With Examples]
======
**This guide explains the basics of the journalctl utility of [Systemd][1] and its various commands. You can use these commands for troubleshooting desktop and server logs in Linux. This is how you can use journalctl to view and analyze Systemd Logs with different examples.**
### Introduction
Many say that Systemd is not good, it is heavy on the system and it is a debated topic always. But you can not deny that it provides a well set of utilities to manage, troubleshoot a system. Imagine you end up with a broken system with no GUI. You probably messed up boot and GRUB as well. In those kinds of scenarios or in general you can boot from a LIVE system, mount your Linux partition and explore the Systemd logs to find out about the problem.
Systemd has three basic components as follows
- **systemd**: System and service manager for Linux operating systems.
- **systemctl**: Command to introspect and control the state of the systemd system and service manager.
- **systemd-analyze**: Provides system boot-up performance statistics and retrieve other state and tracing information from the system and service manager
Apart from these three, there are additional services that systemd provides such as journald, logind, networkd, etc. In this guide we will talk about the journald service of systemd.
### journald systemd journal daemon
By design, systemd provides a centralized way of handing all operating system logs from processes, applications, etc. All these logging events are handled by journald daemon of systemd. The journald daemon collects all logs from everywhere of the Linux operating systems and stores themes as binary data in files.
The advantages of centralized logging of events, system problems as binary data are many. For example, as the system logs are stored as binary and not text you can translate in many ways such as text, JSON objects for various needs. Also, it is super easy to track down to a single event as the logs are stored sequentially via date/time manipulation of the logs.
Remember the log files that journald collects are in thousands of lines and it gets updated for every event, every boot. So if you have a long time running Linux operating system the journal logs size should in GBs. As the logs are in thousands, its better to filter with basic commands to find out more about the system problems.
#### The journald Configuration File
The configuration file of the journald is present in the below path. It contains various flags on how the logging happens. You can take a look at the file and make the changes necessary. But I would recommend not to modify this file unless you know what you are doing.
```
/etc/systemd/journald.conf
```
#### Where journald stores the binary log files
The journald stores the logs in binary format. They are stored inside a directory under this path.
```
/var/log/journal
```
For example, in the below path there is a directory that contains all the system logs to date.
![journalctl log file path][2]
Do not use cat command or use nano or vi to open these files. They would not be displayed properly.
### Use journalctl to View and Analyze Systemd Logs
#### Basic journald command
The basic command to view logs using journal daemon is
```
journalctl
```
![journalctl][3]
This gives you all the journal entries including errors, warnings, etc from all applications and processes. It shows the list with the oldest log at the top and current logs at the bottom. You need to keep pressing ENTER to scroll through it line by line. You can also use PAGE UP and PAGE DOWN keys to scroll. Press q to exit from this view.
#### How to view journal entries for time zones
By default, the journalctl shows the log time in the current system time zone. However, you can easily provide the timezone in your command to convert the same log to a different time zone. For example, to view the logs in UTC, use the below command.
```
journalctl --utc
```
![journalctl --utc][4]
#### How to view only errors, warnings, etc in journal logs
The logs that a system generates have different priorities. Some logs may be a warning which can be ignored or some may be critical errors. You might want to look at only errors, not warnings. That is also possible using the below command.
To view emergency system messages use:
```
journalctl -p 0
```
![journalctl -p 0][5]
Error codes
```
0: emergency
1: alerts
2: critical
3: errors
4: warning
5: notice
6: info
7: debug
```
When you specify the error code, it shows all messages from that code and above. For example, if you specify the below command, it shows all messages with priority 2, 1 and 0
```
journalctl -p 2
```
#### How to view journal logs for a specific boot
When you are running the journalctl command it shows the information from the current boot that is from the current session which you are running. But it is also possible to view information about past boots as well.
Journal logs keep on updating in every reboot. The journald keeps track of the logs in different boots. To view, the boot-wise logs use the below command.
```
journalctl --list-boots
```
![journalctl list-boots][6]
- The first number shows the unique journald boot track number which you can use in the next command to analyze that specific boot.
- The second number the boot ID which also you can specify in the commands.
- The next two date, time combinations are the duration of the logs stored in the respective file. This is super handy if you want to find out a log or error from a specific date, time.
To view a specific boot number you the first number or the boot ID as below.
```
journalctl -b -45
```
```
journalctl -b 8bab42c7e82440f886a3f041a7c95b98
```
![journalctl -b 45][7]
You can also use `-x` switch which can add an explanation of the systemd error messages in your display. This is a lifesaver in certain situations.
```
journalctl -xb -p 3
```
![journalctl -xb][8]
#### How to view journal logs for a specific time, date duration
The journalctl is powerful enough to provide “english” like argument in the command itself for time and date manipulation.
You can use`--since` switch with a combination of `“yesterday”, “today”, “tomorrow”, or “now”.`
Some of the examples of different commands below. You can modify them as per your need. They are self-explanatory. The date, time format in the below commands are `"YYYY-MM-DD HH:MM:SS"`
```
journalctl --since "2020-12-04 06:00:00"
```
```
journalctl --since "2020-12-03" --until "2020-12-05 03:00:00"
```
```
journalctl --since yesterday
```
```
journalctl --since 09:00 --until "1 hour ago"
```
![journalctl --since 09:00 --until][9]
You can combine the above with the error level switches as well.
#### How to see Kernel specific journal logs
The Linux Kernel messages can be extracted from journal logs as well. To view the Kernel messages from the current boot only use the below command.
```
journalctl -k
```
#### How to see journal logs for a service, PID
You can filter out specific logs from a systemd service unit only from the journald logs. For example, to find out the logs from NetworkManager service use the below command.
```
journalctl -u NetworkManager.service
```
![journalctl NetworkManager service][10]
If you do not know the service name, you can use the below command to list the systemd services in your system.
```
systemctl list-units --type=service
```
#### How to view journal logs for a user, group
If you are analyzing server logs this command is helpful where multiple users are logged in. You can first find out about the user id using the below command from the user name. For example, to find out the id of user “`debugpoint`”
```
id -u debugpoint
```
Then use that ID with `_UID` switch to view the logs generated by the user.
```
journalctl _UID=1000 --since today
```
![journalctl _UID][11]
Similarly use `_GID` switch to find out the same for user groups.
#### How to view journal logs for an executable
You can also find out journald logs of a specific program or executable. For example, if you want to find out the messages of gnome-shell, you can run the below command.
```
journalctl /usr/bin/gnome-shell --since today
```
![journalctl gnome-shell][12]
### Closing notes
I hope this guide helps you to use journalctl to view analyze systemd logs on your Linux desktop or server troubleshooting. The systemd journal management extremely powerful if you know how to use the commands, it makes your life a bit easy during debugging time. All major mainstream Linux distribution uses Systemd these days. Ubuntu, Debian, Fedora, Arch they all use systemd for their default OS offerings. In case if you are wondering about systemd-free Linux distributions, you might want to check out [MX-Linux][13], Gentoo, Slackware, Void Linux.
--------------------------------------------------------------------------------
via: https://www.debugpoint.com/systemd-journalctl/
作者:[Arindam][a]
选题:[lkxed][b]
译者:[译者ID](https://github.com/译者ID)
校对:[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译,[Linux中国](https://linux.cn/) 荣誉推出
[a]: https://www.debugpoint.com/author/admin1/
[b]: https://github.com/lkxed
[1]: https://freedesktop.org/wiki/Software/systemd/
[2]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-log-file-path.jpg
[3]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl.jpg
[4]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-utc.jpg
[5]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-p-0.jpg
[6]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-list-boots.jpg
[7]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-b-45.jpg
[8]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-xb.jpg
[9]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-since-0900-until.jpg
[10]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-NetworkManager-service.jpg
[11]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-_UID.jpg
[12]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-gnome-shell.jpg
[13]: https://www.debugpoint.com/tag/mx-linux

View File

@ -0,0 +1,260 @@
[#]: subject: "How to use journalctl to View and Analyze Systemd Logs [With Examples]"
[#]: via: "https://www.debugpoint.com/systemd-journalctl/"
[#]: author: "Arindam https://www.debugpoint.com/author/admin1/"
[#]: collector: "lkxed"
[#]: translator: "Chao-zhi"
[#]: reviewer: " "
[#]: publisher: " "
[#]: url: " "
如何使用 journalctl 查看和分析 Systemd 日志 [附实例] 。
======
**本指南介绍了 [Systemd][1] 的 journalctl 工具及其各种命令的基础知识。你可以使用这些命令对 Linux 中的桌面和服务器日志进行故障诊断。以下是如何使用 journalctl 查看和分析 Systemd 日志的不同例子。**
### 简介
很多人说 Systemd 不好,它对系统的影响很大,这也是一个有争议的话题。但你不能否认的是,它提供了一套完善的工具来管理和排除系统故障。想象一下,当你遇到一个没有 GUI 的坏系统时,你可能会把启动和 GRUB 弄得一团糟。在这种情况下,你可以从一个 live 系统启动,挂上你的 Linux 分区,然后浏览 Systemd 的日志,找出问题所在。
Systemd有三个基本组件如下所示
- **systemd**。Linux 操作系统的系统和服务管理器。
- **systemctl**。命令,用于反观和控制 systemd 系统和服务管理器的状态。
- **systemd-analyze**。提供系统启动时的性能统计,并从系统和服务管理器中检索其他状态和跟踪信息。
除了这三个服务外systemd 还提供其他服务,如 journald、logind、networkd 等。在本指南中,我们将讨论 systemd 的 journald 服务。
### journald - systemd日志服务
根据设计systemd 提供了一个集中的方式来处理所有来自进程、应用程序等的操作系统日志。所有这些日志事件都由 systemd 的 journald 守护进程来处理。journald 守护进程收集所有来自 Linux 操作系统各处的日志,并将其作为二进制数据存储在文件中。
集中记录事件、系统问题作为二进制数据的好处有很多。例如,由于系统日志是以二进制而不是文本形式存储的--你可以以多种方式进行翻译如文本、JSON对象以满足各种需求。另外由于日志是按顺序存储的通过对日志的日期/时间操作,超级容易追踪到单个事件。
请记住journald 收集的日志文件有几千行,而且每次开机都会对每个事件进行更新。因此,如果你有一个长期运行的 Linux 操作系统--日志的大小应该以 GB 为单位。由于有着数以千计的日志,最好用基本命令进行过滤,以了解更多系统问题。
#### journald 配置文件
journald 的配置文件存在于以下路径中。它包含了关于如何进行日志记录的各种标志。你可以看一下这个文件,并进行必要的修改。但我建议不要修改这个文件,除非你知道自己在做什么。
```
/etc/systemd/journald.conf
```
#### journald 存储二进制日志文件的地方
journald 以二进制格式存储日志。它们被保存在这个路径下的一个目录中。
```
/var/log/journal
```
例如,在下面的路径中,有一个目录包含了迄今为止的所有系统日志。
![journalctl log file path][2]
不要使用 cat 命令,也不要使用 nano 或 vi 来打开这些文件。它们将无法正常显示。
### 使用 journalctl 来查看和分析 systemd 日志
#### journald 基本命令
使用 journal daemon 查看日志的基本命令是:
```
journalctl
```
![journalctl][3]
该命令提供了所有应用程序和进程的日志条目,包括错误、警告等。它显示的列表中,最古老的日志在顶部,当前的日志在底部。你需要不断按回车键来逐行滚动浏览。你也可以使用 PAGE UP 和 PAGE DOWN 键来滚动。按 q 键可以退出这个视图。
#### 如何以不同时区的时间查看日志条目
默认情况下journalctl 显示的是当前系统时区的日志时间。然而,你可以很容易地在命令中提供时区,将同一日志转换为不同的时区。例如,要查看 UTC 的日志,请使用以下命令:
```
journalctl --utc
```
![journalctl --utc][4]
#### 如何在日志中只查看错误、警告等信息
系统产生的日志有不同的优先级。有些日志可能是可以忽略的警告,有些可能是重要的错误。你可能想只看错误,不看警告。这也可以用下面的命令来实现。
要查看紧急系统信息,请使用:
```
journalctl -p 0
```
![journalctl -p 0][5]
错误代码:
```
0: 紧急情况
1: 警报
2: 危急
3: 错误
4: 警告
5: 通知
6: 信息
7调试
```
当你指定错误代码时,它显示该等级及比他等级更高的所有信息。例如,如果你指定下面的命令,它会显示所有优先级为 2、1 和 0 的信息:
```
journalctl -p 2
```
#### 如何查看特定启动的日志
当你运行 journalctl 命令时,它会显示当前启动的信息,即你正在运行的会话中的信息。但也可以查看过去启动的信息。
在每次重启时日志都会持续更新。journald 会记录不同启动时的日志。要查看不同启动时的日志,请使用以下命令。
```
journalctl --list-boots
```
![journalctl list-boots][6]
- 第一个数字显示的是 journald 的唯一的启动跟踪号码,你可以在下一个命令中使用它来分析该特定的启动。
- 第二个数字是 boot ID你也可以在命令中指定。
- 接下来的两个日期、时间组合是存储在相应文件中的日志的时间。如果你想找出某个特定日期、时间的日志或错误,这就非常方便了。
要查看一个特定的启动号码,你可以选择第一个号码或启动 ID如下所示。
```
journalctl -b -45
```
```
journalctl -b 8bab42c7e82440f886a3f041a7c95b98
```
![journalctl -b 45][7]
你也可以使用 `-x` 选项,在显示屏上添加 systemd 错误信息的解释。在某些情况下,这是个救命稻草。
```
journalctl -xb -p 3
```
![journalctl -xb][8]
#### 如何查看某一特定时间、日期的日志记录
journalctl 功能强大,可以在命令中提供类似 "english" 的参数,用于时间和日期操作。
你可以使用 `--since` 选项与 `“yesterday”, “today”, “tomorrow”, 或 “now”` 组合。
下面是一些不同命令的例子。你可以根据你的需要修改它们。它们是不言自明的。以下命令中的日期、时间格式为 `"YYYY-MM-DD HH:MM:SS"`
```
journalctl --since "2020-12-04 06:00:00"
```
```
journalctl --since "2020-12-03" --until "2020-12-05 03:00:00"
```
```
journalctl --since yesterday
```
```
journalctl --since 09:00 --until "1 hour ago"
```
![journalctl --since 09:00 --until][9]
你也可以将上述内容与错误级别开关结合起来。
#### 如何查看内核特定的日志记录
Linux 内核信息也可以从日志中提取出来。要查看当前启动时的内核信息,请使用以下命令。
```
journalctl -k
```
#### 如何查看某个服务、PID 的日志
你可以从 journald 日志中过滤出某个 systemd 服务单元的特定日志。例如,如果要查看 NetworkManager 服务的日志,请使用下面的命令。
```
journalctl -u NetworkManager.service
```
![journalctl NetworkManager service][10]
如果你不知道服务名称可以使用下面的命令来列出系统中的systemd服务。
```
systemctl list-units --type=service
```
#### 如何查看用户、组的日志
如果你正在分析服务器日志,在多个用户登录的情况下,这个命令很有帮助。你可以先用下面的命令从用户名中找出用户的 ID。例如要找出用户 "`debugpoint`" 的ID
```
id -u debugpoint
```
然后使用 `_UID` 选项指定该ID与来查看该用户产生的日志。
```
journalctl _UID=1000 --since today
```
![journalctl _UID][11]
同样地,使用 `_GID` 选项也可以查到用户组的情况。
#### 如何查看一个可执行文件的日志
你也可以查看某个特定程序或可执行文件的日志。例如,如果你想找出 gnome-shell 的信息,你可以运行以下命令。
```
journalctl /usr/bin/gnome-shell --since today
```
![journalctl gnome-shell][12]
### 结束语
希望本指南能帮助你使用 journalctl 查看分析 Linux 桌面或服务器上的 systemd 日志排除故障。如果你知道如何使用这些命令systemd 日志管理的功能非常强大,它能让你在调试时的生活变得轻松一些。现在所有主流的 Linux 发行版都使用 systemd。Ubuntu、Debian、Fedora、Arch--它们都使用systemd 作为其默认的操作系统产品。如果你想了解无 systemd 的Linux发行版你可能想看看[MX-Linux][13]、Gentoo、Slackware、Void Linux。
--------------------------------------------------------------------------------
via: https://www.debugpoint.com/systemd-journalctl/
作者:[Arindam][a]
选题:[lkxed][b]
译者:[Chao-zhi](https://github.com/Chao-zhi)
校对:[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译,[Linux中国](https://linux.cn/) 荣誉推出
[a]: https://www.debugpoint.com/author/admin1/
[b]: https://github.com/lkxed
[1]: https://freedesktop.org/wiki/Software/systemd/
[2]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-log-file-path.jpg
[3]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl.jpg
[4]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-utc.jpg
[5]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-p-0.jpg
[6]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-list-boots.jpg
[7]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-b-45.jpg
[8]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-xb.jpg
[9]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-since-0900-until.jpg
[10]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-NetworkManager-service.jpg
[11]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-_UID.jpg
[12]: https://www.debugpoint.com/wp-content/uploads/2020/12/journalctl-gnome-shell.jpg
[13]: https://www.debugpoint.com/tag/mx-linux