Journald : Basic Usage2024/07/02 |
|
This is Basic Usage of Journald that is the Log Management Service Daemon.
|
|
| [1] | By default, Journald is running and many logging data on the System are collected by Journald. Therefore, if [Journald (systemd-journald.service systemd-journald.socket systemd-journald-dev-log.socket)] would be down, collecting of many logging data will also stop. |
|
root@dlp:~# systemctl status systemd-journald.service
* systemd-journald.service - Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
Active: active (running) since Mon 2024-07-01 23:38:32 UTC; 3min 27s ago
TriggeredBy: * systemd-journald.socket
* systemd-journald-audit.socket
* systemd-journald-dev-log.socket
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 350 (systemd-journal)
Status: "Processing requests..."
Tasks: 1 (limit: 4612)
FD Store: 12 (limit: 4224)
Memory: 11.6M (peak: 16.7M)
CPU: 103ms
CGroup: /system.slice/systemd-journald.service
.....
.....
|
| [2] | It's possible to change settings of Journald on [/etc/systemd/journald.conf]. All options are commented out by default, however they are the default parameters of Journald on Ubuntu. |
|
root@dlp:~# cat /etc/systemd/journald.conf [Journal] #Storage=auto #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitIntervalSec=30s #RateLimitBurst=10000 #SystemMaxUse= #SystemKeepFree= #SystemMaxFileSize= #SystemMaxFiles=100 #RuntimeMaxUse= #RuntimeKeepFree= #RuntimeMaxFileSize= #RuntimeMaxFiles=100 #MaxRetentionSec= #MaxFileSec=1month #ForwardToSyslog=no #ForwardToKMsg=no #ForwardToConsole=no #ForwardToWall=yes #TTYPath=/dev/console #MaxLevelStore=debug #MaxLevelSyslog=debug #MaxLevelKMsg=notice #MaxLevelConsole=info #MaxLevelWall=emerg #LineMax=48K #ReadKMsg=yes #Audit=yes |
| [3] | The place of stored logging data is set on [Storage=***] of [/etc/systemd/journald.conf]. For the place of stored logging data, they are also stored in conventional files like [/var/log/syslog] and so on by Rsyslogd with the setting [ForwardToSyslog=yes] on Journald. |
# parameters of [Storage=***] # # volatile : stored only in memory : under the [/run/log/journal] # persistent : stored on disk : under the [/var/log/journal] # but if impossible to write on disk like early boot, fallback to memory # auto : stored on disk if [/var/log/journal] exists # if not exists, stored in memory # none : not stored all data # but forwarding to other targets like Syslog daemon if they are configured # # * storing in memory is not persistent, when system restarted, logging data are cleared # on default settings of Ubuntu, it's set [auto] and also # [/var/log/journal] exists, so logging data are stored in [/var/log/journal]
root@dlp:~#
root@dlp:~# grep Storage /etc/systemd/journald.conf #Storage=auto ll -d /var/log/journal drwxr-sr-x+ 3 root systemd-journal 4096 Apr 26 01:08 /var/log/journal/root@dlp:~# ll -Rh /var/log/journal /var/log/journal: total 12K drwxr-sr-x+ 3 root systemd-journal 4.0K Apr 26 01:08 ./ drwxrwxr-x 10 root syslog 4.0K Jul 1 23:38 ../ drwxr-sr-x+ 2 root systemd-journal 4.0K Jul 1 23:38 7047321890b246dda057d4cc196d631b/ /var/log/journal/7047321890b246dda057d4cc196d631b: total 105M drwxr-sr-x+ 2 root systemd-journal 4.0K Jul 1 23:38 ./ drwxr-sr-x+ 3 root systemd-journal 4.0K Apr 26 01:08 ../ -rw-r-----+ 1 root systemd-journal 8.0M Jul 1 23:45 system.journal -rw-r-----+ 1 root systemd-journal 8.0M Jun 4 23:45 'system@08512921520d4cca928fb792a6d84d4d-000000000000479c-00061a19033c3594.journal' -rw-r-----+ 1 root systemd-journal 8.0M Jul 1 23:38 'system@18cfcd8bebdd485daac3fceef26979eb-0000000000006f98-00061c381268110c.journal' ..... ..... |
| [4] | To show stored logging data by Journald, it's possible with [journalctl] command. |
|
# show all data without any option : results are send to [less] command # if not send to [less], add [--no-pager] option root@dlp:~# journalctl Apr 26 01:08:43 ubuntu kernel: Linux version 6.8.0-31-generic (buildd@lcy02-amd> Apr 26 01:08:43 ubuntu kernel: Command line: BOOT_IMAGE=/vmlinuz-6.8.0-31-gener> Apr 26 01:08:43 ubuntu kernel: KERNEL supported cpus: Apr 26 01:08:43 ubuntu kernel: Intel GenuineIntel Apr 26 01:08:43 ubuntu kernel: AMD AuthenticAMD Apr 26 01:08:43 ubuntu kernel: Hygon HygonGenuine Apr 26 01:08:43 ubuntu kernel: Centaur CentaurHauls Apr 26 01:08:43 ubuntu kernel: zhaoxin Shanghai Apr 26 01:08:43 ubuntu kernel: BIOS-provided physical RAM map: Apr 26 01:08:43 ubuntu kernel: BIOS-e820: [mem 0x0000000000000000-0x00000000000> Apr 26 01:08:43 ubuntu kernel: BIOS-e820: [mem 0x000000000009fc00-0x00000000000> ..... ..... # [-u UNIT] : show logs of a specific UNIT root@dlp:~# journalctl -u cron.service Apr 26 01:09:20 ubuntu systemd[1]: Started cron.service - Regular background pr> Apr 26 01:09:20 ubuntu (cron)[805]: cron.service: Referenced but unset environm> Apr 26 01:09:20 ubuntu cron[805]: (CRON) INFO (pidfile fd = 3) Apr 26 01:09:20 ubuntu cron[805]: (CRON) INFO (Running @reboot jobs) Apr 26 01:15:01 ubuntu CRON[1195]: pam_unix(cron:session): session opened for u> Apr 26 01:15:01 ubuntu CRON[1196]: (root) CMD (command -v debian-sa1 > /dev/nul> ..... .....root@dlp:~# journalctl -u systemd-tmpfiles-clean.timer Apr 26 01:09:20 ubuntu systemd[1]: Started systemd-tmpfiles-clean.timer - Daily> Apr 26 01:37:51 ubuntu systemd[1]: systemd-tmpfiles-clean.timer: Deactivated su> Apr 26 01:37:51 ubuntu systemd[1]: Stopped systemd-tmpfiles-clean.timer - Daily> -- Boot a4eac0760d18461499fa1dd76c93eee3 -- Apr 26 05:18:32 ubuntu systemd[1]: Started systemd-tmpfiles-clean.timer - Daily> Apr 26 05:23:07 ubuntu systemd[1]: systemd-tmpfiles-clean.timer: Deactivated su> Apr 26 05:23:07 ubuntu systemd[1]: Stopped systemd-tmpfiles-clean.timer - Daily> ..... ..... # [-k] : show logs of kernel message root@dlp:~# journalctl -k Jul 01 23:38:32 dlp.srv.world kernel: Linux version 6.8.0-35-generic (buildd@lc> Jul 01 23:38:32 dlp.srv.world kernel: Command line: BOOT_IMAGE=/vmlinuz-6.8.0-3> Jul 01 23:38:32 dlp.srv.world kernel: KERNEL supported cpus: Jul 01 23:38:32 dlp.srv.world kernel: Intel GenuineIntel Jul 01 23:38:32 dlp.srv.world kernel: AMD AuthenticAMD Jul 01 23:38:32 dlp.srv.world kernel: Hygon HygonGenuine Jul 01 23:38:32 dlp.srv.world kernel: Centaur CentaurHauls Jul 01 23:38:32 dlp.srv.world kernel: zhaoxin Shanghai Jul 01 23:38:32 dlp.srv.world kernel: BIOS-provided physical RAM map: ..... ..... # [-p Priority] : show logs of a specific priority root@dlp:~# journalctl -p err Apr 26 01:09:29 ubuntu login[983]: PAM unable to dlopen(pam_lastlog.so): /usr/l> Apr 26 01:09:29 ubuntu login[983]: PAM adding faulty module: pam_lastlog.so -- Boot a4eac0760d18461499fa1dd76c93eee3 -- Apr 26 05:20:07 ubuntu login[791]: PAM unable to dlopen(pam_lastlog.so): /usr/l> Apr 26 05:20:07 ubuntu login[791]: PAM adding faulty module: pam_lastlog.so Apr 26 05:20:33 ubuntu login[929]: PAM unable to dlopen(pam_lastlog.so): /usr/l> ..... ..... # [-g PATTERN] : show logs that include specific word [PATTERN] in [MESSAGE] field root@dlp:~# journalctl -g "apparmor" Apr 26 01:08:43 ubuntu kernel: LSM: initializing lsm=lockdown,capability,landlo> Apr 26 01:08:43 ubuntu kernel: AppArmor: AppArmor initialized Apr 26 01:08:43 ubuntu kernel: AppArmor: AppArmor Filesystem Enabled Apr 26 01:08:43 ubuntu kernel: AppArmor: AppArmor sha256 policy hashing enabled Apr 26 01:08:43 ubuntu kernel: evm: security.apparmor Apr 26 01:08:43 ubuntu systemd[1]: systemd 255.4-1ubuntu8 running in system mod> Apr 26 01:08:43 ubuntu systemd[1]: Starting apparmor.service - Load AppArmor pr> ..... ..... # [-S DATE] : show logs Since DATE # [-U DATE] : show logs Until DATE root@dlp:~# journalctl -S "2024-07-01 00:00:00" -U "2024-07-30 23:59:59" Jul 01 00:30:49 ubuntu kernel: Linux version 6.8.0-35-generic (buildd@lcy02-amd> Jul 01 00:30:49 ubuntu kernel: Command line: BOOT_IMAGE=/vmlinuz-6.8.0-35-gener> Jul 01 00:30:49 ubuntu kernel: KERNEL supported cpus: Jul 01 00:30:49 ubuntu kernel: Intel GenuineIntel Jul 01 00:30:49 ubuntu kernel: AMD AuthenticAMD Jul 01 00:30:49 ubuntu kernel: Hygon HygonGenuine Jul 01 00:30:49 ubuntu kernel: Centaur CentaurHauls Jul 01 00:30:49 ubuntu kernel: zhaoxin Shanghai Jul 01 00:30:49 ubuntu kernel: BIOS-provided physical RAM map: ..... ..... # show help root@dlp:~# journalctl --help
journalctl [OPTIONS...] [MATCHES...]
Query the journal.
Source Options:
--system Show the system journal
--user Show the user journal for the current user
-M --machine=CONTAINER Operate on local container
-m --merge Show entries from all available journals
-D --directory=PATH Show journal files from directory
.....
.....
|
| Sponsored Link |