Linux如何查看系統日誌

在Linux中查看系統日誌的方法主要有：1. 使用journalctl命令（適用於使用systemd的系統），如journalctl -f實時監控日誌，journalctl -u ssh.service查看特定服務日誌，journalctl -p err過濾錯誤級別以上的日誌；2. 查看/var/log目錄下的傳統日誌文件，如/var/log/syslog或/var/log/messages記錄系統事件，/var/log/auth.log記錄登錄嘗試，可用less、tail -f等命令查看；3. 使用dmesg命令查看內核環緩衝信息，dmesg -H --follow可實時顯示帶時間戳的硬件和啟動消息；4. 注意日誌權限和輪轉問題，壓縮日誌可用zless或zcat查看，最終應根據系統類型選擇journalctl或傳統日誌文件進行排查，以完整覆蓋各類日誌需求。

In Linux, system logs provide valuable information about system events, errors, services, and security-related activities. There are several ways to view system logs depending on your distribution and logging system (typically syslog or journald ). Here's how to check them effectively.

1. Using journalctl (for systems with systemd )

Most modern Linux distributions use systemd , which logs events through journald . The journalctl command is the primary tool to access these logs.

• View all logs :

   journalctl

• View recent logs :

   journalctl -n 50

  (Shows the last 50 lines)

• Follow logs in real time :

   journalctl -f

  (Like tail -f , useful for monitoring)

• View logs from today only :

   journalctl --since today

• Check logs for a specific service :

   journalctl -u ssh.service

  (Replace ssh.service with any service name)

• View kernel messages :

   journalctl -k

• Filter by log level (eg, errors and above):

   journalctl -p err

  (Levels: debug, info, notice, warning, err, crit, alert, emerg)

Note: Use sudo if you need to access system-wide logs and aren't in the systemd-journal group.

2. View traditional log files in /var/log

Even with systemd , logs are often also stored in plain text files under /var/log .

Common log files include:

• /var/log/syslog – General system log (on Debian/Ubuntu)
• /var/log/messages – General system log (on RHEL/CentOS/Fedora)
• /var/log/auth.log – Authentication and login attempts (Debian/Ubuntu)
• /var/log/secure – Security and authentication logs (RHEL/CentOS)
• /var/log/kern.log – Kernel-specific messages
• /var/log/boot.log – System boot messages
• /var/log/dmesg – Kernel ring buffer (hardware/driver messages)

You can view them with:

 less /var/log/syslog
tail -f /var/log/auth.log
cat /var/log/dmesg

3. Using dmesg for hardware and boot messages

The dmesg command shows kernel ring buffer messages, useful for hardware issues and early boot problems.

• View all kernel messages:

   dmesg

• Human-readable output with timestamps:

   dmesg -H

• Follow new messages:

   dmesg -H --follow

4. Log management tips

• Permissions : Some logs require sudo to read.
• Log rotation : Old logs may be compressed (eg, syslog.1.gz ) and rotated by logrotate .
• Use zcat or zless to view compressed logs:

   zless /var/log/syslog.1.gz

• On older systems without systemd , tools like rsyslog or syslog-ng handle logging, and logs are only in /var/log .

Basically, start with journalctl -f for real-time monitoring or check /var/log/syslog (or /var/log/messages ) for a quick look. The exact method depends on your system, but these tools cover most cases.

以上是Linux如何查看系統日誌的詳細內容。更多資訊請關注PHP中文網其他相關文章！