Persistence journalctl log clearing command to view detailed explanation of configuration parameters

wheneverE-commercewebmaster encountersMySQL database, Apache and other applications cannot be started as usual,LinuxThe system will prompt you to use journalctl -ex command to view it.

• Related logs can often be found quickly.
• After analyzing the log in this way, the problem can be quickly solved.

What does journal mean?

Journal basic explanation:

• n. Daily, journal, diary; periodicals, journals, magazines; [accounting] ledger
• Variation
• plural journals

Persist journal logs

Persistence is the mechanism for converting program data between persistent and transient states.

In layman's terms, transient data (such as in-memory data that cannot be stored permanently), persistence will persist to persistent data (such as database persistence, which can be stored for a long time).

OnCentOS In 7.X, systemd manages startup logs for all units.

• Systemd-journald is a progressive journal management service managed by systemd.
• It collects logs from the kernel and system daemons are up and running during the early boot phase of the system.
• Standard output and error messages, as well as syslog logs.

journalctl log path

The log service only keeps log files in a single structure.

The following is the CentOS 7 system VestaCPControl panel, save path of journalctl log ▼

/var/log/journal

• Because logs are compressed and formatted binary data, when viewing andPositioningvery fast.

journalctl view log command

Command without any options to make journalctl output all logging ▼

journalctl

• This is basically useless because you'll be immediately "overwhelmed" with a flood of logging that will overwhelm you.

Next, we will learn how to effectively filter valuable log information.

View a specified time periodjournalctlLog

Use the following command options to set the time period ▼

--since
--until

• A time period is responsible for specifying log records before and after a given time.

Time values ​​can be in a variety of formats, such as the following ▼

YYYY-MM-DD HH:MM:SS

如果你想检查在2018年3月8日晚上8点20分之后日志，请输入以下命令 ▼

journalctl --since "2018-03-26 20:20:00"

• If some components of the above format are not filled in, the system will directly fill in the default values.
• For example, if the date part is not populated, the current date is displayed directly.
• If the time part is not populated, "00:00:00" (midnight) is used by default.
• The seconds field can also be left blank.

The default value is "00", for example the following command ▼

journalctl --since "2018-03-26" --until "2018-03-26 03:00"

Additionally, journalctl understands some relative values ​​and named shorthands.

• For example, you could use "yesterday", "today", "tomorrow" or "now".

For example, to get yesterday's log data, you can use the following command ▼

journalctl --since yesterday

To get the logs from 9:00am to the last hour, you can use the following command ▼

journalctl --since 09:00 --until "1 hour ago"

Real-time update view journalctl log

with tail -f command is similar, journalctl supports -f option to display logs in real time ▼

journalctl -f

If you want to view the real-time log of the device, please add the -u option ▼

$ sudo journalctl -f -u prometheus.service

Show only the newest n lines in journalctl

command line options -n Used to control only the latest n lines of log.

The default is to display the latest 10 lines of logs at the end ▼

$ sudo journalctl -n

You can also display a log with a specified number of lines at the end ▼

$ sudo journalctl -n 20

The following is the latest three-line log showing the cron.service service ▼

$ journalctl -u cron.service -n 3

will get Internet marketingPeople use VPSBuilding website, install the VestaCP control panel, buildWordPresswebsite.

use frequently df -h Command to check the VPS disk capacity and find that it is rising at a trend of 1GB per month (remember that it was 1GB last month)

[root@ten ~]# df -h

Filesystem      Size  Used Avail Use% Mounted on

/dev/simfs       20G  7.5G   13G  38% /

devtmpfs        256M     0  256M   0% /dev

tmpfs           256M     0  256M   0% /dev/shm

tmpfs           256M  244K  256M   1% /run

tmpfs           256M     0  256M   0% /sys/fs/cgroup

tmpfs            52M     0   52M   0% /run/user/0

View journalctl logs using the capacity command

Check the current journalctl log using the disk capacity command ▼

journalctl --disk-usage

journalctl empty delete log

Since Linux is a very sensitive operating system, it is easy to cause a system crash if you delete files incorrectly.

Therefore, the way to clean up journalctl logs, please delete them by date and the capacity allowed to be reserved.

journalctl --vacuum-time=2d
journalctl --vacuum-size=500M

If you want to delete log files manually, you need to rotate (rotate) the log before deleting.

systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service

journalctl configure persistent capacity

To enable journald limit persistence configuration, you can modify journald's configuration file ▼

/etc/systemd/journald.conf

SystemMaxUse=16M

ForwardToSyslog=no

Then, restart journald ▼

systemctl restart systemd-journald.service

Is the check log OK?Are the log files intact and undamaged? ▼

journalctl --verify

The following is the VPS disk capacity after cleaning the journalctl log, and the journalctl log capacity▼

[root@ten /]# df -h

Filesystem      Size  Used Avail Use% Mounted on

/dev/simfs       20G  5.7G   15G  29% /

devtmpfs        256M     0  256M   0% /dev

tmpfs           256M     0  256M   0% /dev/shm

tmpfs           256M  308K  256M   1% /run

tmpfs           256M     0  256M   0% /sys/fs/cgroup

tmpfs            52M     0   52M   0% /run/user/0

[root@ten /]# journalctl --disk-usage

Archived and active journals take up 24.0M on disk.

Detailed explanation of persistent journalctl log, this is the end ^_^