有人能向我解释为什么在 Ubuntu 16.04 和 18.04 上 journalctl -f 命令会回到开头吗？
例如请注意，在出现该行的位置跳转回 2 月 4 日-- Reboot --。跟随模式不是意味着从末尾开始跟随吗？
matthewh@xen:~$ journalctl -f
-- Logs begin at Wed 2018-04-18 17:57:48 NZST. --
Jun 08 09:29:04 xen unknown[19540]: hello
Jun 08 09:29:21 xen gnome-shell[3277]: clutter-actor.c:10049: Actor 'dashtodockDashScrollview' tried to allocate a size of 52.00 x -50.00
Jun 08 09:31:30 xen gnome-shell[3277]: clutter-actor.c:10049: Actor 'dashtodockDashScrollview' tried to allocate a size of 52.00 x -50.00
Jun 08 09:31:41 xen cat[19590]: hello2
-- Reboot --
Feb 04 13:03:05 xen systemd-journald[420]: Time spent on flushing to /var is 405.801ms for 1030 entries.
Feb 04 13:03:05 xen kernel: wmi: Mapper loaded
Feb 04 13:03:05 xen kernel: i5500_temp 0000:00:14.3: Sensor seems to be disabled
Feb 04 13:03:05 xen kernel: ACPI Warning: SystemIO range 0x0000000000000828-0x000000000000082F conflicts with OpRegion 0x0000000000000800-0x000000000000084F (\PMRG) (20150930/utaddress-254)
Feb 04 13:03:05 xen kernel: ACPI: If an ACPI driver is available for this device, you should use it instead of the native driver
Feb 04 13:03:05 xen kernel: ACPI Warning: SystemIO range 0x0000000000000530-0x000000000000053F conflicts with OpRegion 0x0000000000000500-0x000000000000053F (\GPS0) (20150930/utaddress-254)
另一个奇怪的行为是，带--cursor=选项的跟随模式可以正常工作约 30 秒，但一旦 30 秒过去或在此期间将另一个条目写入日志，它就会跳回到过去。这是错误、配置问题还是某些东西损坏了？
另一个奇怪的行为是，如果我清理过去 1 小时的数据，它会释放大量空间，但journalctl -f仍然显示历史日志。
例如
matthewh@xen:~$ sudo journalctl --vacuum-time=1h
[sudo] password for matthewh:
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/user-65534@66df57ade95c47cf9eac8bb3bad2fcd6-000000000028c69f-00056a41cbc84fd5.journal (8.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/user-1000@f74fb09ddbf942c48992ffeddad027aa-00000000002823a0-00056a19227c797c.journal (128.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (16.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (72.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (24.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (8.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (8.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (8.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/[email protected]~ (8.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/system@4e816c29657c4ac19594d7c4de14afd7-0000000000000001-00056d4be316a78f.journal (48.0M).
Deleted archived journal /var/log/journal/f899a862e4aa4775b8995564d8da565d/user-1000@b7f2a0f19c9946abab26788729a244c5-00000000000008a0-00056d4bf4c029b5.journal (16.0M).
Vacuuming done, freed 344.0M of archived journals from /var/log/journal/f899a862e4aa4775b8995564d8da565d.
matthewh@xen:/var/log/journal$ journalctl -f
-- Logs begin at Wed 2018-04-18 18:01:40 NZST. --
Jun 08 09:40:12 xen gnome-shell[3277]: clutter-actor.c:10049: Actor 'dashtodockDashScrollview' tried to allocate a size of 52.00 x -50.00
Jun 08 09:40:22 xen sudo[19775]: matthewh : TTY=pts/0 ; PWD=/var/log/journal ; USER=root ; COMMAND=/bin/journalctl --vacuum-time=10m
Jun 08 09:40:22 xen sudo[19775]: pam_unix(sudo:session): session opened for user root by (uid=0)
Jun 08 09:40:22 xen sudo[19775]: pam_unix(sudo:session): session closed for user root
-- Reboot --
Feb 04 13:03:05 xen systemd-journald[420]: Time spent on flushing to /var is 405.801ms for 1030 entries.
Feb 04 13:03:05 xen kernel: wmi: Mapper loaded
Feb 04 13:03:05 xen kernel: i5500_temp 0000:00:14.3: Sensor seems to be disabled
Feb 04 13:03:05 xen kernel: ACPI Warning: SystemIO range 0x0000000000000828-0x000000000000082F conflicts with OpRegion 0x0000000000000800-0x000000000000084F (\PMRG) (20150930/utaddress-254)
Feb 04 13:03:05 xen kernel: ACPI: If an ACPI driver is available for this device, you should use it instead of the native driver
Feb 04 13:03:05 xen kernel: ACPI Warning: SystemIO range 0x0000000000000530-0x000000000000053F conflicts with OpRegion 0x0000000000000500-0x000000000000053F (\GPS0) (20150930/utaddress-254)
看起来 journalctl 程序正在从某个地方读取这些日志，但也许它认为这些日志仍然是当前日志或未来的日志，尽管日期不同。这是真的吗？它可能从哪里读取它们？
答案1
结果是肯定存在某种损坏，/var/log/journal甚至vacuum 10m没有删除旧条目。
我不完全确定 journalctl 如何确定什么是新日志，但出于某种原因，2 月 4 日的日志被视为最新日志，因此它会显示它。
它有一个副作用，就是不按写入的方式显示当前条目。也就是说，follow 不起作用。并且无法使光标工作。
因此解决办法是：
rm -rf /var/log/journal/*
systemd-tmpfiles --create --prefix /var/log/journal
我不需要保留旧日志，因此完全删除就可以了。