journalctl命令来自英文词组journal control的缩写，其功能是查看指定的日志信息。在RHEL 7/CentOS 7及以后版本的Linux系统中，systemd服务统一管理了所有服务的启动日志，带来的好处就是可以只用journalctl一个命令来查看全部的日志信息了。

语法格式：journalctl 参数 对象

常用参数：

-a	显示所有字段信息		-o	设置日志条目格式
-b	显示本次系统启动的日志信息		-p	依据优先级筛选
-c	从指定位置开始显示条目		-q	静默执行模式
-D	设置目录路径		-r	反选内容后再显示
-f	追踪日志内容		-u	显示指定服务的日志
-k	显示内核日志		--help	显示帮助信息
-m	显示所有可用日志		--version	显示版本信息
-n	设置日志条数

参考示例

查看系统中全部的日志信息：

[root@linuxcool ~]# journalctl  -- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>  May 18 02:12:18 linuxprobe.com kernel: Linux version 4.18.0-80.el8.x86_64 (mock>  May 18 02:12:18 linuxprobe.com kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vm>  May 18 02:12:18 linuxprobe.com kernel: Disabled fast string operations  ………………省略部分输出信息………………

指定查看内核日志信息：

[root@linuxcool ~]# journalctl -k  -- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>  May 18 02:12:18 linuxprobe.com kernel: Linux version 4.18.0-80.el8.x86_64 (mock> May 18 02:12:18 linuxprobe.com kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vm>  May 18 02:12:18 linuxprobe.com kernel: Disabled fast string operations  ………………省略部分输出信息………………

指定查看本次系统启动的日志信息：

[root@linuxcool ~]# journalctl -b -- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:15:02 CS>  May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x001:>  May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x002:>  May 18 02:12:18 linuxprobe.com kernel: x86/fpu: Supporting XSAVE feature 0x004:>  ………………省略部分输出信息……………… 

指定查看某个服务程序的日志信息：

[root@linuxcool ~]# journalctl -u sshd  -- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:17:01 CS>  May 18 02:12:22 linuxcool.com systemd[1]: Starting OpenSSH server daemon...  May 18 02:12:22 linuxcool.com sshd[1109]: Server listening on 0.0.0.0 port 22.  May 18 02:12:22 linuxcool.com sshd[1109]: Server listening on :: port 22.  May 18 02:12:22 linuxcool.com systemd[1]: Started OpenSSH server daemon ………………省略部分输出信息……………… 

指定查看最近10条日志信息：

[root@linuxcool ~]# journalctl -n 10 -- Logs begin at Thu 2023-05-18 02:12:18 CST, end at Sat 2023-05-28 13:17:01 CS>  May 28 13:01:01 linuxcool.com run-parts[3541]: (/etc/cron.hourly) finished 0ana>  May 28 13:15:00 linuxcool.com dbus-daemon[980]: [system] Activating via systemd>  May 28 13:15:00 linuxcool.com systemd[1]: Starting Fingerprint Authentication D>  May 28 13:15:00 linuxcool.com dbus-daemon[980]: [system] Successfully activated>  May 28 13:15:00 linuxcool.com systemd[1]: Started Fingerprint Authentication Da>  May 28 13:15:02 linuxcool.com gdm-password][3666]: gkr-pam: unlocked login keyr>  May 28 13:15:02 linuxcool.com NetworkManager[1093]: [1653714902.2810] a>  May 28 13:17:01 linuxcool.com anacron[2921]: Job `cron.monthly' started  May 28 13:17:01 linuxcool.com anacron[2921]: Job `cron.monthly' terminated  May 28 13:17:01 linuxcool.com anacron[2921]: Normal exit (3 jobs run) 

持续追踪最新的日志信息，保持刷新内容：

[root@linuxcool ~]# journalctl -f  -- Logs begin at Thu 2023-05-18 02:12:18 CST. --  May 28 13:01:01 linuxcool.com run-parts[3541]: (/etc/cron.hourly) finished 0anacron  May 28 13:15:00 linuxcool.com dbus-daemon[980]: [system] Activating via systemd: service name='net.reactivated.Fprint' unit='fprintd.service' requested by ':1.177' (uid=0 pid=2222 comm="/usr/bin/gnome-shell " label="unconfined_u: unconfined_r:unconfined_t:s0-s0:c0.c1023")  May 28 13:15:00 linuxcool.com systemd[1]: Starting Fingerprint Authentication Daemon...  May 28 13:15:00 linuxcool.com dbus-daemon[980]: [system] Successfully activated service 'net.reactivated.Fprint'  May 28 13:15:00 linuxcool.com systemd[1]: Started Fingerprint Authentication Daemon. May 28 13:15:02 linuxcool.com gdm-password][3666]: gkr-pam: unlocked login keyring  May 28 13:15:02 linuxcool.com NetworkManager[1093]: [1653714902.2810] agent-manager: req[0x7fdcc8007190, :1.177/org.gnome.Shell.NetworkAgent/0]: agent registered  May 28 13:17:01 linuxcool.com anacron[2921]: Job `cron.monthly' started  May 28 13:17:01 linuxcool.com anacron[2921]: Job `cron.monthly' terminated  May 28 13:17:01 linuxcool.com anacron[2921]: Normal exit (3 jobs run) ………………省略部分输出信息………………