linux-journal日志文件特别大怎么办,journal日志文件学习

今天发现磁盘容量不多了,就去清理磁盘,发现这个文件特别大:journal,特此来学习下

bash 复制代码
root@main1:/var/log# du -sh * | sort -rh
3.9G	journal
14M	syslog.1
2.6M	auth.log
1.7M	syslog
1.4M	nginx
1.2M	auth.log.1
972K	cloud-init.log
784K	btmp
756K	syslog.5.gz
752K	syslog.4.gz
752K	syslog.3.gz

查看日志

bash 复制代码
# 查看所有日志(默认情况下只保存本次启动的日志)
$ sudo journalctl

# 显示尾部指定行数的日志,默认10行
$ sudo journalctl -n 20

# 实时滚动显示最新日志
$ sudo journalctl -f

# 查看指定时间的日志
$ sudo journalctl --since yesterday
$ sudo journalctl --since="2023-12-22 16:52:18"
$ sudo journalctl --since "30 min ago"
$ sudo journalctl --since "2023-12-22 16:52:18" --until "2023-12-22 23:52:18"
$ sudo journalctl --since 09:00 --until "1 hour ago"

# 查看内核日志,过滤掉应用日志
$ sudo journalctl -k

# 查看系统本次启动的日志
$ sudo journalctl -b
$ sudo journalctl -b -0

# 查看上一次启动的日志
$ sudo journalctl -b -1

# 查看指定优先级及其以上级别的日志,共有8级 0: emerg 1: alert 2: crit 3: err 4: warning 5: notice 6: info 7: debug
# -b 不加任何参数时,表示显示当前引导周期的日志。这意味着只显示自最近一次启动以来的日志。
# -b N: N 是一个整数,表示要显示第 N 个引导周期的日志。例如,-b 0 表示显示最新的引导周期,-b 1 表示显示上一个引导周期,以此类推
$ sudo journalctl -p err -b

# 日志默认分页输出,--no-pager 改为正常的标准输出
$ sudo journalctl --no-pager

# 以单行 JSON 格式输出
$ sudo journalctl -b -u nginx.service -o json

# 以多行 JSON 可读性更好的格式输出
$ sudo journalctl -b -u nginx.service  -o json-pretty

查看指定服务日志

bash 复制代码
# 查看指定服务的日志
$ sudo journalctl /usr/sbin/sshd

# 查看指定进程的日志
$ sudo journalctl _PID=1

# 查看某个路径的脚本的日志
$ sudo journalctl /bin/bash

# 查看指定用户的日志
$ sudo journalctl _UID=1000 --since today

# 查看某个 Unit 的日志
# 单元(unit)通常是 systemd 服务的一个抽象,用于表示系统中正在运行的各种服务或任务
$ sudo journalctl -u nginx.service
$ sudo journalctl -u nginx.service --since today

# 合并显示多个 Unit 的日志
$ journalctl -u nginx.service -u ssh.service --since today

查看调整存储

bash 复制代码
# 显示日志占据的硬盘空间
$ sudo journalctl --disk-usage

# 仅保留500MB大小的日志文件
$ sudo journalctl --vacuum-size=500M

# 指定日志文件保存多久
$ sudo journalctl --vacuum-time=1years

# 仅保留最近一个月的日志文件
$ sudo journalctl --vacuum-time=1m

# 仅保留最近2天的日志文件
$ sudo journalctl --vacuum-time=2d

那我就用这个命令设置下:

bash 复制代码
sudo journalctl --vacuum-size=500M
bash 复制代码
root@main1:/var/log# sudo journalctl --vacuum-size=500M
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000051cc5d-00061339453d0178.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000053cc12-0006135b3f1eef94.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000055c9c2-0006137b543284b3.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000057c7bc-0006139bf5d2dfb3.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000059c637-000613bd9b2a1255.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005bc5cc-000613e093e093a9.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005dc475-0006140224bbf06b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000005fc2eb-0006142376145477.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000061c0ab-00061443ee4e321d.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000063b8a4-00061462d01f6943.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000065b60f-0006148311b86d49.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000067b5d8-000614a527ea10fb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000069b5a3-000614c6ed919071.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006bad29-000614e5bde0dd56.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006daae6-00061505c78cc43b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000006fa8d6-0006152782bf9c19.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000071a87b-0006154957068898.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000073a822-0006156b5640dafb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000075a7ec-0006158d5e6e7836.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000077a7b5-000615afc5a2ce3d.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-000000000079a777-000615d2298f4e78.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007b9eca-000615f1e374d03b.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007d9e6d-00061615581b86c0.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-00000000007f9bc9-0006163643e9ddcb.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000819c06-0006165858845fce.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000839bba-0006167a9ee9be99.journal (128.0M).
Deleted archived journal /var/log/journal/20200717161206652139342161693131/system@b20cba847f7c40a3b50fe3db0842186f-0000000000859afe-0006169d0a9a36ec.journal (128.0M).
Vacuuming done, freed 3.3G of archived journals from /var/log/journal/20200717161206652139342161693131.
Vacuuming done, freed 0B of archived journals from /var/log/journal.
root@main1:/var/log# du -sh * | sort -rh
497M	journal
14M	syslog.1
2.6M	auth.log
1.7M	syslog
1.4M	nginx
1.2M	auth.log.1
972K	cloud-init.log
784K	btmp
756K	syslog.5.gz
752K	syslog.4.gz
752K	syslog.3.gz
752K	syslog.2.gz
748K	syslog.6.gz
744K	syslog.7.gz

竟然自动清理了

相关推荐
IC 见路不走31 分钟前
LeetCode 第91题:解码方法
linux·运维·服务器
翻滚吧键盘44 分钟前
查看linux中steam游戏的兼容性
linux·运维·游戏
小能喵1 小时前
Kali Linux Wifi 伪造热点
linux·安全·kali·kali linux
汀沿河1 小时前
8.1 prefix Tunning与Prompt Tunning模型微调方法
linux·运维·服务器·人工智能
zly35001 小时前
centos7 ping127.0.0.1不通
linux·运维·服务器
kikikidult2 小时前
(2025.07)解决——ubuntu20.04系统开机黑屏,左上角光标闪烁
笔记·ubuntu
小哥山水之间2 小时前
基于dropbear实现嵌入式系统ssh服务端与客户端完整交互
linux
ldj20202 小时前
2025 Centos 安装PostgreSQL
linux·postgresql·centos
翻滚吧键盘2 小时前
opensuse tumbleweed上安装显卡驱动
linux
cui_win3 小时前
【内存】Linux 内核优化实战 - net.ipv4.tcp_tw_reuse
linux·网络·tcp/ip