持久化配置
持久化配置
# /etc/systemd/journald.conf
Storage=persistent # 持久化到 /var/log/journal
SystemMaxUse=2G # 控制磁盘占用
ForwardToSyslog=yes # 同时转发给 rsyslog
# 应用配置
systemctl restart systemd-journald查询示例
查询示例
journalctl -u sshd --since "1 hour ago"
journalctl -p err --since today
journalctl _PID=1234 -o json-pretty | head