translated

translated

sources/tech/20221109.4 ⭐️⭐️ How to use journalctl to View and Analyze Systemd Logs [With Examples].md

@@ -7,58 +7,58 @@
 [#]: publisher: " "
 [#]: url: " "
 
-How to use journalctl to View and Analyze Systemd Logs [With Examples]
+如何使用 journalctl 查看和分析 Systemd 日志 [附实例] 。
 ======
 
-**This guide explains the basics of the journalctl utility of [Systemd][1] and its various commands. You can use these commands for troubleshooting desktop and server logs in Linux. This is how you can use journalctl to view and analyze Systemd Logs with different examples.**
+**本指南介绍了 [Systemd][1] 的 journalctl 工具及其各种命令的基础知识。你可以使用这些命令对 Linux 中的桌面和服务器日志进行故障诊断。以下是如何使用 journalctl 查看和分析 Systemd 日志的不同例子。**
 
-### Introduction
+### 简介
 
-Many say that Systemd is not good, it is heavy on the system and it is a debated topic always. But you can not deny that it provides a well set of utilities to manage, troubleshoot a system. Imagine you end up with a broken system with no GUI. You probably messed up boot and GRUB as well. In those kinds of scenarios or in general – you can boot from a LIVE system, mount your Linux partition and explore the Systemd logs to find out about the problem.
+很多人说 Systemd 不好，它对系统的影响很大，这也是一个有争议的话题。但你不能否认的是，它提供了一套完善的工具来管理和排除系统故障。想象一下，当你遇到一个没有 GUI 的坏系统时，你可能会把启动和 GRUB 弄得一团糟。在这种情况下，你可以从一个 live 系统启动，挂上你的 Linux 分区，然后浏览 Systemd 的日志，找出问题所在。
 
-Systemd has three basic components as follows –
+Systemd有三个基本组件，如下所示：
 
-- **systemd**: System and service manager for Linux operating systems.
-- **systemctl**: Command to introspect and control the state of the systemd system and service manager.
-- **systemd-analyze**: Provides system boot-up performance statistics and retrieve other state and tracing information from the system and service manager
+- **systemd**。Linux 操作系统的系统和服务管理器。
+- **systemctl**。命令，用于反观和控制 systemd 系统和服务管理器的状态。
+- **systemd-analyze**。提供系统启动时的性能统计，并从系统和服务管理器中检索其他状态和跟踪信息。
 
-Apart from these three, there are additional services that systemd provides such as – journald, logind, networkd, etc. In this guide we will talk about the journald service of systemd.
+除了这三个服务外，systemd 还提供其他服务，如 journald、logind、networkd 等。在本指南中，我们将讨论 systemd 的 journald 服务。
 
-### journald – systemd journal daemon
+### journald - systemd日志服务
 
-By design, systemd provides a centralized way of handing all operating system logs from processes, applications, etc. All these logging events are handled by journald daemon of systemd. The journald daemon collects all logs from everywhere of the Linux operating systems and stores themes as binary data in files.
+根据设计，systemd 提供了一个集中的方式来处理所有来自进程、应用程序等的操作系统日志。所有这些日志事件都由 systemd 的 journald 守护进程来处理。journald 守护进程收集所有来自 Linux 操作系统各处的日志，并将其作为二进制数据存储在文件中。
 
-The advantages of centralized logging of events, system problems as binary data are many. For example, as the system logs are stored as binary and not text – you can translate in many ways such as text, JSON objects for various needs. Also, it is super easy to track down to a single event as the logs are stored sequentially via date/time manipulation of the logs.
+集中记录事件、系统问题作为二进制数据的好处有很多。例如，由于系统日志是以二进制而不是文本形式存储的--你可以以多种方式进行翻译，如文本、JSON对象，以满足各种需求。另外，由于日志是按顺序存储的，通过对日志的日期/时间操作，超级容易追踪到单个事件。
 
-Remember the log files that journald collects are in thousands of lines and it gets updated for every event, every boot. So if you have a long time running Linux operating system – the journal logs size should in GBs. As the logs are in thousands, it’s better to filter with basic commands to find out more about the system problems.
+请记住，journald 收集的日志文件有几千行，而且每次开机都会对每个事件进行更新。因此，如果你有一个长期运行的 Linux 操作系统--日志的大小应该以 GB 为单位。由于有着数以千计的日志，最好用基本命令进行过滤，以了解更多系统问题。
 
-#### The journald Configuration File
+#### journald 配置文件
 
-The configuration file of the journald is present in the below path. It contains various flags on how the logging happens. You can take a look at the file and make the changes necessary. But I would recommend not to modify this file unless you know what you are doing.
+journald 的配置文件存在于以下路径中。它包含了关于如何进行日志记录的各种标志。你可以看一下这个文件，并进行必要的修改。但我建议不要修改这个文件，除非你知道自己在做什么。
 
 ```
 /etc/systemd/journald.conf
 ```
 
-#### Where journald stores the binary log files
+#### journald 存储二进制日志文件的地方
 
-The journald stores the logs in binary format. They are stored inside a directory under this path.
+journald 以二进制格式存储日志。它们被保存在这个路径下的一个目录中。
 
 ```
 /var/log/journal
 ```
 
-For example, in the below path there is a directory that contains all the system logs to date.
+例如，在下面的路径中，有一个目录包含了迄今为止的所有系统日志。
 
 ![journalctl log file path][2]
 
-Do not use cat command or use nano or vi to open these files. They would not be displayed properly.
+不要使用 cat 命令，也不要使用 nano 或 vi 来打开这些文件。它们将无法正常显示。
 
-### Use journalctl to View and Analyze Systemd Logs
+### 使用 journalctl 来查看和分析 systemd 日志
 
-#### Basic journald command
+#### journald 基本命令
 
-The basic command to view logs using journal daemon is –
+使用 journal daemon 查看日志的基本命令是：
 
 ```
 journalctl
@@ -66,11 +66,11 @@ journalctl
 
 ![journalctl][3]
 
-This gives you all the journal entries including errors, warnings, etc from all applications and processes. It shows the list with the oldest log at the top and current logs at the bottom. You need to keep pressing ENTER to scroll through it line by line. You can also use PAGE UP and PAGE DOWN keys to scroll. Press q to exit from this view.
+该命令提供了所有应用程序和进程的日志条目，包括错误、警告等。它显示的列表中，最古老的日志在顶部，当前的日志在底部。你需要不断按回车键来逐行滚动浏览。你也可以使用 PAGE UP 和 PAGE DOWN 键来滚动。按 q 键可以退出这个视图。
 
-#### How to view journal entries for time zones
+#### 如何以不同时区的时间查看日志条目
 
-By default, the journalctl shows the log time in the current system time zone. However, you can easily provide the timezone in your command to convert the same log to a different time zone. For example, to view the logs in UTC, use the below command.
+默认情况下，journalctl 显示的是当前系统时区的日志时间。然而，你可以很容易地在命令中提供时区，将同一日志转换为不同的时区。例如，要查看 UTC 的日志，请使用以下命令：
 
 ```
 journalctl --utc
@@ -78,11 +78,11 @@ journalctl --utc
 
 ![journalctl --utc][4]
 
-#### How to view only errors, warnings, etc in journal logs
+#### 如何在日志中只查看错误、警告等信息
 
-The logs that a system generates have different priorities. Some logs may be a warning which can be ignored or some may be critical errors. You might want to look at only errors, not warnings. That is also possible using the below command.
+系统产生的日志有不同的优先级。有些日志可能是可以忽略的警告，有些可能是重要的错误。你可能想只看错误，不看警告。这也可以用下面的命令来实现。
 
-To view emergency system messages use:
+要查看紧急系统信息，请使用：
 
 ```
 journalctl -p 0
@@ -90,30 +90,30 @@ journalctl -p 0
 
 ![journalctl -p 0][5]
 
-Error codes
+错误代码：
 
 ```
-0: emergency
-1: alerts
-2: critical
-3: errors
-4: warning
-5: notice
-6: info
-7: debug
+0: 紧急情况
+1: 警报
+2: 危急
+3: 错误
+4: 警告
+5: 通知
+6: 信息
+7：调试
 ```
 
-When you specify the error code, it shows all messages from that code and above. For example, if you specify the below command, it shows all messages with priority 2, 1 and 0
+当你指定错误代码时，它显示该等级及比他等级更高的所有信息。例如，如果你指定下面的命令，它会显示所有优先级为 2、1 和 0 的信息：
 
 ```
 journalctl -p 2
 ```
 
-#### How to view journal logs for a specific boot
+#### 如何查看特定启动的日志
 
-When you are running the journalctl command it shows the information from the current boot that is from the current session which you are running. But it is also possible to view information about past boots as well.
+当你运行 journalctl 命令时，它会显示当前启动的信息，即你正在运行的会话中的信息。但也可以查看过去启动的信息。
 
-Journal logs keep on updating in every reboot. The journald keeps track of the logs in different boots. To view, the boot-wise logs use the below command.
+在每次重启时，日志都会持续更新。journald 会记录不同启动时的日志。要查看不同启动时的日志，请使用以下命令。
 
 ```
 journalctl --list-boots
@@ -121,11 +121,13 @@ journalctl --list-boots
 
 ![journalctl list-boots][6]
 
-- The first number shows the unique journald boot track number which you can use in the next command to analyze that specific boot.
-- The second number the boot ID which also you can specify in the commands.
-- The next two date, time combinations are the duration of the logs stored in the respective file. This is super handy if you want to find out a log or error from a specific date, time.
+- 第一个数字显示的是 journald 的唯一的启动跟踪号码，你可以在下一个命令中使用它来分析该特定的启动。
 
-To view a specific boot number you the first number or the boot ID as below.
+- 第二个数字是 boot ID，你也可以在命令中指定。
+
+- 接下来的两个日期、时间组合是存储在相应文件中的日志的时间。如果你想找出某个特定日期、时间的日志或错误，这就非常方便了。
+
+要查看一个特定的启动号码，你可以选择第一个号码或启动 ID，如下所示。
 
 ```
 journalctl -b -45
@@ -137,7 +139,7 @@ journalctl -b 8bab42c7e82440f886a3f041a7c95b98
 
 ![journalctl -b 45][7]
 
-You can also use `-x` switch which can add an explanation of the systemd error messages in your display. This is a lifesaver in certain situations.
+你也可以使用 `-x` 选项，在显示屏上添加 systemd 错误信息的解释。在某些情况下，这是个救命稻草。
 
 ```
 journalctl -xb -p 3
@@ -145,13 +147,14 @@ journalctl -xb -p 3
 
 ![journalctl -xb][8]
 
-#### How to view journal logs for a specific time, date duration
+#### 如何查看某一特定时间、日期的日志记录
 
-The journalctl is powerful enough to provide “english” like argument in the command itself for time and date manipulation.
+journalctl 功能强大，可以在命令中提供类似 "english" 的参数，用于时间和日期操作。
 
-You can use`--since` switch with a combination of `“yesterday”, “today”, “tomorrow”, or “now”.`
+你可以使用 `--since` 选项与 `“yesterday”, “today”, “tomorrow”, 或 “now”` 组合。
+
+下面是一些不同命令的例子。你可以根据你的需要修改它们。它们是不言自明的。以下命令中的日期、时间格式为 `"YYYY-MM-DD HH:MM:SS"`
 
-Some of the examples of different commands below. You can modify them as per your need. They are self-explanatory. The date, time format in the below commands are `"YYYY-MM-DD HH:MM:SS"`
 
 ```
 journalctl --since "2020-12-04 06:00:00"
@@ -171,19 +174,19 @@ journalctl --since 09:00 --until "1 hour ago"
 
 ![journalctl --since 09:00 --until][9]
 
-You can combine the above with the error level switches as well.
+你也可以将上述内容与错误级别开关结合起来。
 
-#### How to see Kernel specific journal logs
+#### 如何查看内核特定的日志记录
 
-The Linux Kernel messages can be extracted from journal logs as well. To view the Kernel messages from the current boot only use the below command.
+Linux 内核信息也可以从日志中提取出来。要查看当前启动时的内核信息，请使用以下命令。
 
 ```
 journalctl -k
 ```
 
-#### How to see journal logs for a service, PID
+#### 如何查看某个服务、PID 的日志
 
-You can filter out specific logs from a systemd service unit only from the journald logs. For example, to find out the logs from NetworkManager service use the below command.
+你可以从 journald 日志中过滤出某个 systemd 服务单元的特定日志。例如，如果要查看 NetworkManager 服务的日志，请使用下面的命令。
 
 ```
 journalctl -u NetworkManager.service
@@ -191,21 +194,21 @@ journalctl -u NetworkManager.service
 
 ![journalctl NetworkManager service][10]
 
-If you do not know the service name, you can use the below command to list the systemd services in your system.
+如果你不知道服务名称，可以使用下面的命令来列出系统中的systemd服务。
 
 ```
 systemctl list-units --type=service
 ```
 
-#### How to view journal logs for a user, group
+#### 如何查看用户、组的日志
 
-If you are analyzing server logs this command is helpful where multiple users are logged in. You can first find out about the user id using the below command from the user name. For example, to find out the id of user “`debugpoint`” –
+如果你正在分析服务器日志，在多个用户登录的情况下，这个命令很有帮助。你可以先用下面的命令从用户名中找出用户的 ID。例如，要找出用户 "`debugpoint`" 的ID：
 
 ```
 id -u debugpoint
 ```
 
-Then use that ID with `_UID` switch to view the logs generated by the user.
+然后使用 `_UID` 选项指定该ID与来查看该用户产生的日志。
 
 ```
 journalctl _UID=1000 --since today
@@ -213,11 +216,11 @@ journalctl _UID=1000 --since today
 
 ![journalctl _UID][11]
 
-Similarly use `_GID` switch to find out the same for user groups.
+同样地，使用 `_GID` 选项也可以查到用户组的情况。
 
-#### How to view journal logs for an executable
+#### 如何查看一个可执行文件的日志
 
-You can also find out journald logs of a specific program or executable. For example, if you want to find out the messages of gnome-shell, you can run the below command.
+你也可以查看某个特定程序或可执行文件的日志。例如，如果你想找出 gnome-shell 的信息，你可以运行以下命令。
 
 ```
 journalctl /usr/bin/gnome-shell --since today
@@ -225,9 +228,9 @@ journalctl /usr/bin/gnome-shell --since today
 
 ![journalctl gnome-shell][12]
 
-### Closing notes
+### 结束语
 
-I hope this guide helps you to use journalctl to view analyze systemd logs on your Linux desktop or server troubleshooting. The systemd journal management extremely powerful if you know how to use the commands, it makes your life a bit easy during debugging time. All major mainstream Linux distribution uses Systemd these days. Ubuntu, Debian, Fedora, Arch – they all use systemd for their default OS offerings. In case if you are wondering about systemd-free Linux distributions, you might want to check out [MX-Linux][13], Gentoo, Slackware, Void Linux.
+希望本指南能帮助你使用 journalctl 查看分析 Linux 桌面或服务器上的 systemd 日志，排除故障。如果你知道如何使用这些命令，systemd 日志管理的功能非常强大，它能让你在调试时的生活变得轻松一些。现在所有主流的 Linux 发行版都使用 systemd。Ubuntu、Debian、Fedora、Arch--它们都使用systemd 作为其默认的操作系统产品。如果你想了解无 systemd 的Linux发行版，你可能想看看[MX-Linux][13]、Gentoo、Slackware、Void Linux。
 
 --------------------------------------------------------------------------------