centos8.4中的journalctl使用-摩杜云开发者社区

journalctl 用来查询 systemd-journald 服务收集到的日志。systemd-journald 服务是 systemd init 系统提供的收集系统日志的服务。journalctl通常用来查询systemd管理的Unit的日志信息。

[root@ocky-Linux-8-4 ~]# journalctl --help
journalctl [OPTIONS...] [MATCHES...]

Query the journal.

Options:
     --system                Show the system journal
     --user                  Show the user journal for the current user
  -M --machine=CONTAINER     Operate on local container
  -S --since=DATE            Show entries not older than the specified date
  -U --until=DATE            Show entries not newer than the specified date
  -c --cursor=CURSOR         Show entries starting at the specified cursor
     --after-cursor=CURSOR   Show entries after the specified cursor
     --show-cursor           Print the cursor after all the entries
  -b --boot[=ID]             Show current boot or the specified boot
     --list-boots            Show terse information about recorded boots
  -k --dmesg                 Show kernel message log from the current boot
  -u --unit=UNIT             Show logs from the specified unit
     --user-unit=UNIT        Show logs from the specified user unit
  -t --identifier=STRING     Show entries with the specified syslog identifier
  -p --priority=RANGE        Show entries with the specified priority
  -g --grep=PATTERN          Show entries with MESSAGE matching PATTERN
     --case-sensitive[=BOOL] Force case sensitive or insenstive matching
  -e --pager-end             Immediately jump to the end in the pager
  -f --follow                Follow the journal
  -n --lines[=INTEGER]       Number of journal entries to show
     --no-tail               Show all lines, even in follow mode
  -r --reverse               Show the newest entries first
  -o --output=STRING         Change journal output mode (short, short-precise,
                               short-iso, short-iso-precise, short-full,
                               short-monotonic, short-unix, verbose, export,
                               json, json-pretty, json-sse, cat, with-unit)
     --output-fields=LIST    Select fields to print in verbose/export/json modes
     --utc                   Express time in Coordinated Universal Time (UTC)
  -x --catalog               Add message explanations where available
     --no-full               Ellipsize fields
  -a --all                   Show all fields, including long and unprintable
  -q --quiet                 Do not show info messages and privilege warning
     --no-pager              Do not pipe output into a pager
     --no-hostname           Suppress output of hostname field
  -m --merge                 Show entries from all available journals
  -D --directory=PATH        Show journal files from directory
     --file=PATH             Show journal file
     --root=ROOT             Operate on files below a root directory
     --interval=TIME         Time interval for changing the FSS sealing key
     --verify-key=KEY        Specify FSS verification key
     --force                 Override of the FSS key pair with --setup-keys

Commands:
  -h --help                  Show this help text
     --version               Show package version
  -N --fields                List all field names currently used
  -F --field=FIELD           List all values that a specified field takes
     --disk-usage            Show total disk usage of all journal files
     --vacuum-size=BYTES     Reduce disk usage below specified size
     --vacuum-files=INT      Leave only the specified number of journal files
     --vacuum-time=TIME      Remove journal files older than specified time
     --verify                Verify journal file consistency
     --sync                  Synchronize unwritten journal messages to disk
     --flush                 Flush all journal data from /run into /var
     --rotate                Request immediate rotation of the journal files
     --header                Show journal header information
     --list-catalog          Show all message IDs in the catalog
     --dump-catalog          Show entries in the message catalog
     --update-catalog        Update the message catalog database
     --new-id128             Generate a new 128-bit ID
     --setup-keys            Generate a new FSS key pair
lines 14-66/66 (END)

1.journalctl用法

(1).查看所有日志（默认情况下，只保存本次启动的日志）

journalctl

-- Logs begin at Fri 2021-11-19 09:41:46 CST, end at Fri 2021-11-19 13:01:01 CST. --
Nov 19 09:41:46 localhost.localdomain kernel: Linux version 4.18.0-305.3.1.el8_4.x86_64 (mockbuild@ord1-prod-x86build003.svc.aws.rockylinux.org) (gcc version 8.4.1 20200928 (Red Hat 8.4>
Nov 19 09:41:46 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos2)/vmlinuz-4.18.0-305.3.1.el8_4.x86_64 root=/dev/mapper/rl-root ro crashkernel=auto resume=/dev/mapper/r>
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[3]:  960, xstate_sizes[3]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[4]: 1024, xstate_sizes[4]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[5]: 1088, xstate_sizes[5]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[6]: 1152, xstate_sizes[6]:  512
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[7]: 1664, xstate_sizes[7]: 1024
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0xff, context size is 2688 bytes, using 'standard' format.
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-provided physical RAM map:
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffdffff] usable
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000bffe0000-0x00000000bfffffff] reserved
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable

(2).查看内核日志（不显示应用日志）

root@ocky-Linux-8-4 ~]# journalctl -k 
-- Logs begin at Fri 2021-11-19 09:41:46 CST, end at Fri 2021-11-19 13:01:01 CST. --
Nov 19 09:41:46 localhost.localdomain kernel: Linux version 4.18.0-305.3.1.el8_4.x86_64 (mockbuild@ord1-prod-x86build003.svc.aws.rockylinux.org) (gcc version 8.4.1 20200928 (Red Hat 8.4>
Nov 19 09:41:46 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos2)/vmlinuz-4.18.0-305.3.1.el8_4.x86_64 root=/dev/mapper/rl-root ro crashkernel=auto resume=/dev/mapper/r>
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[3]:  960, xstate_sizes[3]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[4]: 1024, xstate_sizes[4]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[5]: 1088, xstate_sizes[5]:   64
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[6]: 1152, xstate_sizes[6]:  512
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: xstate_offset[7]: 1664, xstate_sizes[7]: 1024
Nov 19 09:41:46 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0xff, context size is 2688 bytes, using 'standard' format.
Nov 19 09:41:46 localhost.localdomain kernel: BIOS-provided physical RAM map:

(3).查看系统本次启动的日志

journalctl -b

(4).查看上一次启动的日志（需更改设置）

在该[Journal]部分下，将该Storage=选项设置为 persistent 以启用持久记录：

vim /etc/systemd/journald.conf

centos8.4中的journalctl使用_优先级

在您的服务器上启用了保存以前的引导时，journalctl提供了一些命令来帮助您将引导作为分割单位来使用。要查看journald知道的引导，请使用以下–list-boots选项journalctl：

[root@ocky-Linux-8-4 ~]# journalctl --list-boots
-1 45bea3c8b1d64502b645856369b015cc Fri 2021-11-19 14:21:35 CST—Fri 2021-11-19 14:25:35 CST
 0 b91e19e4f5554920802c689baa7d6bd8 Fri 2021-11-19 14:25:59 CST—Fri 2021-11-19 14:27:55 CST
[root@ocky-Linux-8-4 ~]#

这将为每次启动显示一行。第一列是启动的偏移量，可用于轻松引用启动journalctl。如果您需要绝对参考，则启动ID位于第二列。您可以通过在结束时列出的两个时间规范来指出引导会话引用的时间。

要显示来自这些引导的信息，您可以使用来自第一列或第二列的信息。

例如，要查看上一次启动的日志，请使用-1带有该-b标志的相对指针：

journalctl -b -1

[root@ocky-Linux-8-4 ~]# journalctl -b -1
-- Logs begin at Fri 2021-11-19 14:21:35 CST, end at Fri 2021-11-19 14:27:55 CST. --
Nov 19 14:21:35 localhost.localdomain kernel: Linux version 4.18.0-305.3.1.el8_4.x86_64 (mockbuild@ord1-prod-x86build003.svc.aws.rockylinux.org) (gcc version 8.4.1 20200928 (Red Hat 8.4>
Nov 19 14:21:35 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos2)/vmlinuz-4.18.0-305.3.1.el8_4.x86_64 root=/dev/mapper/rl-root ro crashkernel=auto resume=/dev/mapper/r>
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[3]:  960, xstate_sizes[3]:   64
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[4]: 1024, xstate_sizes[4]:   64
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[5]: 1088, xstate_sizes[5]:   64
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[6]: 1152, xstate_sizes[6]:  512
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[7]: 1664, xstate_sizes[7]: 1024
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0xff, context size is 2688 bytes, using 'standard' format.
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-provided physical RAM map:
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffdffff] usable
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000bffe0000-0x00000000bfffffff] reserved
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
Nov 19 14:21:35 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable
Nov 19 14:21:35 localhost.localdomain kernel: NX (Execute Disable) protection: active
Nov 19 14:21:35 localhost.localdomain kernel: SMBIOS 2.8 present.

(5).查看指定时间的日志

可以使用–since和–until选项过滤任意时间限制，这些限制分别显示给定时间之前或之后的条目。例如："显示2021年11月19号，14点20分30秒到当前时间之间的所有日志信息"

[root@ocky-Linux-8-4 ~]# journalctl --since="2021-11-19 14:20:30"
-- Logs begin at Fri 2021-11-19 14:21:35 CST, end at Fri 2021-11-19 14:27:55 CST. --
Nov 19 14:21:35 localhost.localdomain kernel: Linux version 4.18.0-305.3.1.el8_4.x86_64 (mockbuild@ord1-prod-x86build003.svc.aws.rockylinux.org) (gcc version 8.4.1 20200928 (Red Hat 8.4>
Nov 19 14:21:35 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos2)/vmlinuz-4.18.0-305.3.1.el8_4.x86_64 root=/dev/mapper/rl-root ro crashkernel=auto resume=/dev/mapper/r>
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x020: 'AVX-512 opmask'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x040: 'AVX-512 Hi256'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x080: 'AVX-512 ZMM_Hi256'
Nov 19 14:21:35 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256

另外，journal还能够理解部分相对值及命名简写。例如，大家可以使用“yesterday”、“today”、“tomorrow”或者“now”等表达。另外，我们也可以使用“-”或者“+”设定相对值，或者使用“ago”之前的表达。

例如获取昨天的日志如下：

journalctl --since="yesterday"

获取某一个时间段到当前时间的前一个小时的日志

journalctl --since 09:00 --until "1 hour ago"

获取当前时间的前20分钟的日志

journalctl --since "20 min ago"

获取某一天到某一个时间段的日志信息

journalctl --since "2021-11-18" --until "2021-11-19 15:00"

2.按消息兴趣过滤

(1).按服务

查看mysqld服务的日志信息

[root@ocky-Linux-8-4 ~]# journalctl -u mysqld.service      
-- Logs begin at Fri 2021-11-19 14:21:35 CST, end at Fri 2021-11-19 16:01:01 CST. --
Nov 19 14:21:39 ocky-Linux-8-4 systemd[1]: Starting LSB: start and stop MySQL...
Nov 19 14:21:42 ocky-Linux-8-4 mysqld[883]: Starting MySQL... SUCCESS!
Nov 19 14:21:42 ocky-Linux-8-4 systemd[1]: Started LSB: start and stop MySQL.
Nov 19 14:25:33 ocky-Linux-8-4 systemd[1]: Stopping LSB: start and stop MySQL...
Nov 19 14:25:34 ocky-Linux-8-4 mysqld[2532]: Shutting down MySQL. SUCCESS!
Nov 19 14:25:34 ocky-Linux-8-4 systemd[1]: mysqld.service: Succeeded.
Nov 19 14:25:34 ocky-Linux-8-4 systemd[1]: Stopped LSB: start and stop MySQL.
-- Reboot --
Nov 19 14:26:03 ocky-Linux-8-4 systemd[1]: Starting LSB: start and stop MySQL...
Nov 19 14:26:06 ocky-Linux-8-4 mysqld[879]: Starting MySQL... SUCCESS!
Nov 19 14:26:06 ocky-Linux-8-4 systemd[1]: Started LSB: start and stop MySQL.
[root@ocky-Linux-8-4 ~]#

(2).按进程、用户或者群组ID

由于某些服务当中包含多个子进程，因此如果我们希望通过进程ID实现查询，也可以使用相关过滤机制。

这里需要指定_PID字段。例如，如果PID为8227，则可输入：

journalctl _PID=8227

(3).按优先级

管理员们可能感兴趣的另一种过滤机制为信息优先级。尽管以更为详尽的方式查看日志也很有必要，不过在理解现有信息时，低优先级日志往往会分散我们的注意力并导致理解混乱。

大家可以使用journalctl配合-p选项显示特定优先级的信息，从而过滤掉优先级较低的信息。

例如，只显示错误级别或者更高的日志条目：

journalctl -p err -b

[root@hospital-web1 ~]# journalctl -p err -b
-- Logs begin at Fri 2021-09-17 04:19:02 CST, end at Fri 2021-11-19 16:17:01 CST. --
Sep 18 17:13:17 hospital-web1 sshd[14641]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 24 11:27:10 hospital-web1 sshd[28287]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:56:19 hospital-web1 sshd[16906]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:57:32 hospital-web1 sshd[17089]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:57:58 hospital-web1 sshd[17237]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 27 16:46:49 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 19 10:09:06 hospital-web1 sshd[19498]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 19 14:30:58 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 20 08:04:46 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 19 08:24:20 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 20 10:50:25 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 28 17:25:11 hospital-web1 sshd[7772]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 28 17:36:40 hospital-web1 sshd[13865]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 29 18:45:34 hospital-web1 sshd[10930]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 03 11:10:59 hospital-web1 sshd[16852]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 05 18:04:05 hospital-web1 sshd[27039]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 10 11:28:15 hospital-web1 sshd[2731]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
[root@hospital-web1 ~]#

这将只显示被标记为错误、严重、警告或者紧急级别的信息。Journal的这种实现方式与标准syslog信息在级别上是一致的。大家可以使用优先级名称或者其相关量化值。以下各数字为由最高到最低优先级：

    0: emerg
    1: alert
    2: crit
    3: err
    4: warning
    5: notice
    6: info
    7: debug

例如：

[root@hospital-web1 ~]# journalctl -p 3 -b
-- Logs begin at Fri 2021-09-17 04:19:02 CST, end at Fri 2021-11-19 16:58:01 CST. --
Sep 18 17:13:17 hospital-web1 sshd[14641]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 24 11:27:10 hospital-web1 sshd[28287]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:56:19 hospital-web1 sshd[16906]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:57:32 hospital-web1 sshd[17089]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 26 16:57:58 hospital-web1 sshd[17237]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Sep 27 16:46:49 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 19 10:09:06 hospital-web1 sshd[19498]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 19 14:30:58 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 20 08:04:46 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 19 08:24:20 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 20 10:50:25 hospital-web1 smartd[739]: System clock time adjusted to the past. Resetting next wakeup time.
Oct 28 17:25:11 hospital-web1 sshd[7772]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 28 17:36:40 hospital-web1 sshd[13865]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Oct 29 18:45:34 hospital-web1 sshd[10930]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 03 11:10:59 hospital-web1 sshd[16852]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 05 18:04:05 hospital-web1 sshd[27039]: pam_systemd(sshd:session): Failed to release session: Interrupted system call
Nov 10 11:28:15 hospital-web1 sshd[2731]: pam_systemd(sshd:session): Failed to release session: Interrupted system call