Shulou(Shulou.com)06/01 Report--

This article introduces you what is the primary guide of Linux server administrator Journald, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Journald is a new Syslog method for Linux servers, which marks the end of text log files. Now that the log information is written to a binary file and read using journalctl, the Linux administrator will need some practice to get this information.

Next-generation Linux distributions such as Red Hat Enterprise Linux 7 and SUSE Linux Enterprise Server 12 use systemd management services. Journal is a component of systemd and is handled by journald. It captures Syslog information, kernel log information, as well as information from the original RAM disk, early startup information, and information written to STDOUT and STDERR data streams in all services. Journald is rapidly changing the way the server handles log information and how administrators access it.

Say goodbye to the log file

There is no location for log files in the systemd and journald world. The journald log is written to the binary file, on the Red Hat system, in / run/log/journal. You should not and cannot use the page to open the file. Instead, use journalctl to view the content. This command displays all login information to the server (see Table 1).

Table 1:journalctl output table looks like the default format.

Apr 04 09:48:59 localhost.localdomain chronyd [768]: Can't synchronise: no majority Apr 04 09:50:01 localhost.localdomain systemd [1]: Starting Session 3 of user root. Apr 04 09:50:01 localhost.localdomain systemd [1]: Started Session 3 of user root. Apr 04 09:50:01 localhost.localdomain CROND [3699]: (root) CMD (/ usr/lib64/sa/sa1 1 1) Apr 04 09:50:03 localhost.localdomain chronyd [768]: Selected source 46.249.47.127 Apr 04 09:50:03 localhost.localdomain chronyd [768]: System clock wrong by-2.417074 seconds, adjustment started Apr 04 09:50:36 localhost.localdomain pulseaudio [3163]: [alsa-sink] alsa-sink.c: ALSA woke us up to write new data to the device But there Apr 04 09:50:36 localhost.localdomain pulseaudio [3163]: [alsa-sink] alsa-sink.c: Most likely this is a bug in the ALSA driver 'snd_ens1371'. Apr 04 09:50:36 localhost.localdomain pulseaudio [3163]: [alsa-sink] alsa-sink.c: We were woken up with POLLOUT set-- however a subsequent s Apr 04 09:51:07 localhost.localdomain chronyd [768]: Selected source 81.171.44.131 Apr 04 09:52:12 localhost.localdomain chronyd [3163]: System clock wrong by 0.669116 seconds, adjustment started Apr 04 09:53:17 localhost.lo

Don't worry, journalctl has many filtering options. Journalctl-b filters the information generated at startup. Journalctl-- since=yesterday only displays information that has been logged in since yesterday. Administrators can search for information from a specific range of days: for example, journalctl-- since=2014-03-15-- until= "2014-03-17 23:59:59". Use journalctl-u httpd since=00:00-- until=8:00 to view the httpd process that logged in last night. If the administrator has advanced journald filtering options, it is easier to analyze log files.

In some cases, the default log information displayed by journalctl is not enough in detail. For more information, set the output format to verbose, using the command journalctl-o verbose-n.

Table 2: by displaying verbose log information, Linux administrators can get more information from log files.

Fri 2014-04-04 10 Virtue 12 CEST 32.072521 CEST [52ddd97575747a18c6378d388b2b9ffisti] bc03fb52eddb41 b0bb4829ae19c1c286 mister 8f1dd 5f2transfert4f633145a58d9 PRIORITY=6 _ UID=0 _ GID=0 _ BOOT_ID=bc03fb52eddb41b0bb4829ae19c1c286 _ MACHINE_ID=1fbfd90ac4fc49919fe1b63d6bcf9097 _ HOSTNAME=localhost.localdomain SYSLOG_FACILITY=3 _ TRANSPORT=syslog _ SYSTEMD_CGROUP=/system.slice/network.service _ SYSTEMD_UNIT=network.service SYSLOG_IDENTIFIER=dhclient _ COMM=dhclient E=/usr/sbin/dhclient _ CMDLINE=/sbin/dhclient-H localhost-1-q-lf/var/lib/dhclient/dhclient-0b5faf33-6df0-4f11-bbb9-659b5cd940e9-ens33.lease-pf / var/run/ _ CAP_EFFECTIVE=0000000000203402 _ SELINUX_CONTEXT=system_u:system_r:dhcpc_t:s0 SYSLOG_PID=1760 _ PID=1760 MESSAGE=bound to 192.168.4.232-- renewal in 892seconds. _ SOURCE_REALTIME_TIMESTAMP=1396599152072521

Logrotate and remote Log

Some of the modes of operation that you are used to have changed. The system Logrotate, which closes and archives log files, is becoming larger and larger. On journald, there is no need to cycle through the log files. It is built to monitor the remaining space on the storage volume. If the volume is almost full, delete the old records and free up space. To set a * size for the journald log, modify the SystemMaxUse parameter in the / etc/systemd/journal.conf file.

Remote logging is another matter. If your data center has a remote log server, you should keep it. Journald is not a complete replacement for centralized logging servers, such as rsyslog or syslog-ng do. Journald does not have the option to replace log files from other servers or devices. There is no option to specify which log server's log events can be forwarded. If you want journald to store log information elsewhere, * forward the information to [r] syslog [{d-ng}], where the centralized logs are processed.

This is the end of the preliminary guide on Linux server administrator Journald. I hope the above content can be of some help and learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.