journalctl---查看systemd所有日志（内核日志和应用日志）
日志的配置文件是/etc/systemd/journald.conf
[root@k8s-node1 kubernetes]# journalctl --help
journalctl [OPTIONS...] [MATCHES...]
Query the journal.
Flags:
--system Show the system journal
--user Show the user journal for the current user
-M --machine=CONTAINER Operate on local container
-S --since=DATE Show entries not older than the specified date
-U --until=DATE Show entries not newer than the specified date
-c --cursor=CURSOR Show entries starting at the specified cursor
--after-cursor=CURSOR Show entries after the specified cursor
--show-cursor Print the cursor after all the entries
-b --boot[=ID] Show current boot or the specified boot
--list-boots Show terse information about recorded boots
-k --dmesg Show kernel message log from the current boot
-u --unit=UNIT Show logs from the specified unit
-t --identifier=STRING Show entries with the specified syslog identifier
-p --priority=RANGE Show entries with the specified priority
-e --pager-end Immediately jump to the end in the pager
-f --follow Follow the journal
-n --lines[=INTEGER] Number of journal entries to show
--no-tail Show all lines, even in follow mode
-r --reverse Show the newest entries first
-o --output=STRING Change journal output mode (short, short-iso,
short-precise, short-monotonic, verbose,
export, json, json-pretty, json-sse, cat)
--utc Express time in Coordinated Universal Time (UTC)
-x --catalog Add message explanations where available
--no-full Ellipsize fields
-a --all Show all fields, including long and unprintable
-q --quiet Do not show privilege warning
--no-pager Do not pipe output into a pager
-m --merge Show entries from all available journals
-D --directory=PATH Show journal files from directory
--file=PATH Show journal file
--root=ROOT Operate on catalog files underneath the root ROOT
--interval=TIME Time interval for changing the FSS sealing key
--verify-key=KEY Specify FSS verification key
--force Override of the FSS key pair with --setup-keys
Commands:
-h --help Show this help text
--version Show package version
-F --field=FIELD List all values that a specified field takes
--new-id128 Generate a new 128-bit ID
--disk-usage Show total disk usage of all journal files
--vacuum-size=BYTES Reduce disk usage below specified size
--vacuum-time=TIME Remove journal files older than specified date
--flush Flush all journal data from /run into /var
--header Show journal header information
--list-catalog Show all message IDs in the catalog
--dump-catalog Show entries in the message catalog
--update-catalog Update the message catalog database
--setup-keys Generate a new FSS key pair
--verify Verify journal file consistency
查看所有日志（默认情况下 ，只保存本次启动的日志）
#journalctl
查看内核日志（不显示应用日志）
journalctl -k
查看系统本次启动的日志
#journalctl -b
#
#journalctl -b -0
#
查看指定时间的日志
#journalctl --since="2021-09-16 14:22:02"
#
#journalctl --since "30 min ago"
#
#journalctl --since yesterday
#
#journalctl --since "2021-01-01" --until "2021-09-16 13:40"
#
#journalctl --since 07:30 --until "2 hour ago"
显示尾部的最新10行日志
#journalctl -n
显示尾部指定行数的日志
#journalctl -n 15
实时滚动显示最新日志
#journalctl -f
#
#与tail -f类似
查看指定进程的日志
#journalctl _PID=665
查看某个路径的脚本的日志
#journalctl /usr/bin/bash
查看指定用户的日志
#journalctl UID=33 --since today
查看某个 Unit 的日志
#journalctl -u nginx.service
#journalctl -u nginx.service --since today
实时滚动显示某个 Unit 的最新日志
#journalctl -u nginx.service -f
合并显示多个 Unit 的日志
# journalctl -u nginx.service -u php-fpm.service --since today
查看指定优先级（及其以上级别）的日志，共有8级
## 0: emerg
## 1: alert
## 2: crit
## 3: err
## 4: warning
## 5: notice
## 6: info
## 7: debug
日志默认分页输出，--no-pager 改为正常的标准输出
#journalctl --no-pager
以 JSON 格式（单行）输出
#journalctl -b -u nginx.service -o json
以 JSON 格式（多行）输出，可读性更好
#journalctl -b -u nginx.serviceqq -o json-pretty
显示日志占据的硬盘空间
#journalctl --disk-usage
指定日志文件占据的最大空间，默认为8M
#journalctl --vacuum-size=1M
指定日志文件保存多久
#journalctl --vacuum-time=1years
