{{tag>SystemD}} # Systemd journalctl journal logs Voir https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs ## Requête sur les logs, chercher et trouver Trouver les logs entres deux dates Voir [[find_entre_deux_dates]] ~~~bash journalctl --since "2016-10-18 06:50" --until "2016-10-18 09:00" journalctl --since yesterday -p err ~~~ Par service et/ou par PID ~~~bash journalctl -u pacemaker.service --since "2017-02-24 16:00" -p warning journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service ~~~ Voir aussi ~~~bash ps -f -p 28097 systemctl status 28097 # Par PPID ps -f --ppid 1 ~~~ Erreur au boot ~~~bash journalctl -b -p err ~~~ tailf ~~~bash # dmesg -l warn journalctl -f -p warning ~~~ Ouvrir un fichier spécifique ~~~bash journalctl --file /tmp/plop.journal ~~~ Filtrer les logs json ~~~bash journalctl -u nginx -o json-pretty | jq '. | select(.SYSLOG_IDENTIFIER=="plop") ~~~ Les commandes sudo ~~~ # journalctl -b -t sudo -p 5 -u session-*.scope Sep 12 08:19:01 vmdeb01 sudo[601]: admin : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash ~~~ ### Options sur le forme Arguments : * `--no-pager` * `-f` : tail -f ## Configuration ### Rendre persistant journalctl Source : https://geekeries.de-labrusse.fr/?p=3189 Par défaut journalctl affiche uniquement les logs du dernier boot ~~~ # journalctl --boot=-1 Failed to look up boot -1: Cannot assign requested address ~~~ Pour avoir les logs persistant : `/etc/systemd/journald.conf` ~~~ini [Journal] #Storage=auto Storage=persistent Compress=yes #SystemMaxUse= SystemMaxUse=250M #ForwardToSyslog=yes ~~~ ~~~bash mkdir /var/log/journal systemd-tmpfiles --create --prefix /var/log/journal systemctl restart systemd-journald ~~~ ## Journalctl et container Source : https://docs.docker.com/engine/logging/drivers/journald/ | | | | ---------------- | ------------------------------------------------------------------------------- | |CONTAINER_ID | The container ID truncated to 12 characters. | |CONTAINER_ID_FULL | The full 64-character container ID. | |CONTAINER_NAME | The container name at the time it was started. If you use docker rename to rename a container, the new name isn't reflected in the journal entries. | |CONTAINER_TAG,\ SYSLOG_IDENTIFIER| The container tag ( log tag option documentation). | |CONTAINER_PARTIAL_MESSAGE | A field that flags log integrity. Improve logging of long log lines. | |IMAGE_NAME | The name of the container image. | ### Retrieve log messages with journalctl Use the journalctl command to retrieve log messages. You can apply filter expressions to limit the retrieved messages to those associated with a specific container: ~~~bash sudo journalctl CONTAINER_NAME=webserver ~~~ You can use additional filters to further limit the messages retrieved. The `-b` flag only retrieves messages generated since the last system boot: ~~~bash sudo journalctl -b CONTAINER_NAME=webserver ~~~ The -o flag specifies the format for the retrieved log messages. Use `-o json` to return the log messages in JSON format. ~~~bash sudo journalctl -o json CONTAINER_NAME=webserver ~~~ View logs for a container with a TTY enabled If TTY is enabled on a container you may see [10B blob data] in the output when retrieving log messages. The reason for that is that \r is appended to the end of the line and journalctl doesn't strip it automatically unless `--all` is set: ~~~bash sudo journalctl -b CONTAINER_NAME=webserver --all ~~~ #### Journalctl container et Python Retrieve log messages with the journal API This example uses the systemd Python module to retrieve container logs: ~~~python import systemd.journal reader = systemd.journal.Reader() reader.add_match('CONTAINER_NAME=web') for msg in reader: print '{CONTAINER_ID_FULL}: {MESSAGE}'.format(**msg) ~~~ ### Autres `/etc/systemd/journald.conf` ~~~ini [Journal] RateLimitInterval=10s RateLimitBurst=6000 ~~~ ## Pb ### Pb plus de logs avec journalctl ni dans /var/log/message `/var/log/message` vide ? ~~~ # journalctl No journal files were found. -- No entries -- ~~~ Solution ~~~bash systemctl restart systemd-journald systemctl restart rsyslog.service ~~~