Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:systemd_journalctl_journal_logs [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:systemd_journalctl_journal_logs [2026/06/30 21:46] (Version actuelle) – Jean-Baptiste
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>SystemD}}
+# Systemd journalctl journal logs
+Voir https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs
+## Requête sur les logs, chercher et trouver
+Trouver les logs entres deux dates
+Voir [[find_entre_deux_dates]]
+~~~bash
+journalctl --since "2016-10-18 06:50" --until "2016-10-18 09:00"
+journalctl --since yesterday -p err
+~~~
+Par service et/ou par PID
+~~~bash
+journalctl -u pacemaker.service --since "2017-02-24 16:00" -p warning
+journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
+~~~
+Voir aussi
+~~~bash
+ps -f -p 28097
+systemctl status 28097
+# Par PPID
+ps -f --ppid 1
+~~~
+Erreur au boot
+~~~bash
+journalctl -b -p err
+~~~
+tailf
+~~~bash
+# dmesg -l warn
+journalctl -f -p warning
+~~~
+Ouvrir un fichier spécifique
+~~~bash
+journalctl --file /tmp/plop.journal
+~~~
+Filtrer les logs json
+~~~bash
+journalctl -u nginx -o json-pretty  | jq '. | select(.SYSLOG_IDENTIFIER=="plop")
+~~~
+Les commandes sudo
+~~~
+# journalctl -b -t sudo -p 5 -u session-*.scope
+Sep 12 08:19:01 vmdeb01 sudo[601]:    admin : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash
+~~~
+### Options sur le forme
+Arguments :
+* `--no-pager`
+* `-f` : tail -f
+## Configuration
+### Rendre persistant journalctl
+Source : https://geekeries.de-labrusse.fr/?p=3189
+Par défaut journalctl affiche uniquement les logs du dernier boot
+~~~
+# journalctl --boot=-1
+Failed to look up boot -1: Cannot assign requested address
+~~~
+Pour avoir les logs persistant :
+`/etc/systemd/journald.conf`
+~~~ini
+[Journal]
+#Storage=auto
+Storage=persistent
+Compress=yes
+#SystemMaxUse=
+SystemMaxUse=250M
+#ForwardToSyslog=yes
+~~~
+~~~bash
+mkdir /var/log/journal
+systemd-tmpfiles --create --prefix /var/log/journal
+systemctl restart systemd-journald
+~~~
+## Journalctl et container
+Source : https://docs.docker.com/engine/logging/drivers/journald/
+|                  |	                                                                             |
+| ---------------- | ------------------------------------------------------------------------------- |
+|CONTAINER_ID      |	The container ID truncated to 12 characters.                                 |
+|CONTAINER_ID_FULL |	The full 64-character container ID.                                          |
+|CONTAINER_NAME	   | The container name at the time it was started. If you use docker rename to rename a container, the new name isn't reflected in the journal entries.                                                 |
+|CONTAINER_TAG,\ SYSLOG_IDENTIFIER|	The container tag ( log tag option documentation).           |
+|CONTAINER_PARTIAL_MESSAGE |	A field that flags log integrity. Improve logging of long log lines. |
+|IMAGE_NAME         |	The name of the container image.                                             |
+### Retrieve log messages with journalctl
+Use the journalctl command to retrieve log messages. You can apply filter expressions to limit the retrieved messages to those associated with a specific container:
+~~~bash
+sudo journalctl CONTAINER_NAME=webserver
+~~~
+You can use additional filters to further limit the messages retrieved. The `-b` flag only retrieves messages generated since the last system boot:
+~~~bash
+sudo journalctl -b CONTAINER_NAME=webserver
+~~~
+The -o flag specifies the format for the retrieved log messages. Use `-o json` to return the log messages in JSON format.
+~~~bash
+sudo journalctl -o json CONTAINER_NAME=webserver
+~~~
+View logs for a container with a TTY enabled
+If TTY is enabled on a container you may see [10B blob data] in the output when retrieving log messages. The reason for that is that \r is appended to the end of the line and journalctl doesn't strip it automatically unless `--all` is set:
+~~~bash
+sudo journalctl -b CONTAINER_NAME=webserver --all
+~~~
+#### Journalctl container et Python
+Retrieve log messages with the journal API
+This example uses the systemd Python module to retrieve container logs:
+~~~python
+import systemd.journal
+reader = systemd.journal.Reader()
+reader.add_match('CONTAINER_NAME=web')
+for msg in reader:
+    print '{CONTAINER_ID_FULL}: {MESSAGE}'.format(**msg)
+~~~
+### Autres
+`/etc/systemd/journald.conf`
+~~~ini
+[Journal]
+RateLimitInterval=10s
+RateLimitBurst=6000
+~~~
+## Pb
+### Pb plus de logs avec journalctl ni dans /var/log/message
+`/var/log/message` vide ?
+~~~
+# journalctl
+No journal files were found.
+-- No entries --
+~~~
+Solution
+~~~bash
+systemctl restart systemd-journald
+systemctl restart rsyslog.service
+~~~