如何使用JournalCtl查看特定服務的日誌？

要使用journalctl查看特定服務的日誌，1.可通過\_SYSTEMD\_UNIT參數指定服務名過濾日誌，如journalctl \_SYSTEMD\_UNIT=sshd.service；2.若不確定服務名，可用systemctl list-units --type=service列出所有服務；3.使用-f參數實時監控日誌輸出，如journalctl -f \_SYSTEMD\_UNIT=httpd.service；4.結合-n或-e參數限制顯示行數或跳至最新日誌；5.通過--boot-id或時間範圍（--since與--until）限定日誌範圍；6.還可使用--output切換日誌格式，\_PID過濾進程日誌，USER\_UNIT查看用戶級服務日誌，以及--vacuum-time清理舊日誌以節省空間。

To view logs for a specific service using journalctl , you typically filter the logs by the service name using the _SYSTEMD_UNIT field. This method gives you clean and relevant log output tied directly to the service you're troubleshooting.

Filter Logs by Service Name

The most common way to look at logs for a specific service is by using the _SYSTEMD_UNIT option followed by the service file name. For example:

 journalctl _SYSTEMD_UNIT=sshd.service

This command shows all logs related to the SSH daemon. You can replace sshd.service with the name of any systemd service running on your system.

If you're not sure about the exact service name, you can list all active services with:

 systemctl list-units --type=service

That helps avoid typos or incorrect service names when filtering logs.

View Logs in Real Time

Sometimes you want to monitor what's happening as it happens. In that case, use the -f flag to follow the log output in real time:

 journalctl -f _SYSTEMD_UNIT=httpd.service

This is especially useful when testing configuration changes or debugging issues that happen during runtime. It works similarly to tail -f , giving you a live feed of new log entries.

You might also want to combine this with other options like limiting the number of lines shown or starting from the most recent logs. For example:

• Show only the last 100 lines:

   journalctl -n 100 -f _SYSTEMD_UNIT=httpd.service

• Start from the latest entries (not the full history):

   journalctl -e -f _SYSTEMD_UNIT=nginx.service

These variations help you focus on the most relevant data without getting overwhelmed by older logs.

Combine with Boot ID or Time Range

By default, journalctl shows logs across multiple reboots. But if you're troubleshooting an issue that happened during a specific period, it's better to narrow down the scope.

One way is to filter by boot ID. Use this command to list all previous boots:

 journalctl --list-boots

Then, pick a boot ID and run:

 journalctl _SYSTEMD_UNIT=mysqld.service --boot-id=abc123def456

Alternatively, you can specify a time range:

 journalctl _SYSTEMD_UNIT=redis.service --since "1 hour ago" --until "now"

Or for a specific date:

 journalctl _SYSTEMD_UNIT=cron.service --since "2024-04-05 10:00:00" --until "2024-04-05 12:00:00"

This makes it easier to pinpoint events that occurred during a known window—especially helpful when chasing intermittent issues.

Bonus Tips

• Use --output for different formats : If you need structured data (like JSON), try:

   journalctl _SYSTEMD_UNIT=docker.service --output=json

• Filter by PID or user unit : Sometimes logs come from user-level services or specific processes:

   journalctl _PID=1234
  journalctl USER_UNIT=myapp.service

• Clear old logs to save space :

   journalctl --vacuum-time=7d

  It's not complicated once you get used to the syntax, but it's easy to overlook some of the more advanced filters unless you use them regularly.

  以上是如何使用JournalCtl查看特定服務的日誌？的詳細內容。更多資訊請關注PHP中文網其他相關文章！