日常檢查服務(wù)的時(shí)候，從portainer那里進(jìn)去看容器日志的時(shí)候，發(fā)現(xiàn)右上角出現(xiàn)紅色的感嘆號(hào)：Unable to retrieve container logs。

因?yàn)橹皼](méi)出現(xiàn)過(guò)這樣的問(wèn)題，所以就先上服務(wù)器上用命令docker logs -f containerID看日志，發(fā)現(xiàn)日志也是動(dòng)不了，還是停留在某個(gè)時(shí)間的日志記錄上。

想了一下不應(yīng)該是服務(wù)的日志打印出問(wèn)題，先照著Google搜索了一遍，發(fā)現(xiàn)都沒(méi)有跟我的問(wèn)題相匹配的。因?yàn)槿罩居袝r(shí)能收集顯示，有些日志不可以，應(yīng)該是跟docker設(shè)置的日志引擎有問(wèn)題。

本來(lái)是想整一套EFK的，但是感覺(jué)現(xiàn)在日志量還不夠大，所以并沒(méi)有修改docker的日志引擎，還是默認(rèn)的journald

[root@ad-official xiaoxiao]# docker info|grep Logging
 WARNING: You're not using the default seccomp profile
Logging Driver: journald

journald的官方文檔上有這么一個(gè)說(shuō)明：

man journald.conf ... RateLimitInterval=, RateLimitBurst= Configures the rate limiting that is applied to all messages generated on the system. If, in the time interval defined by RateLimitInterval=, more messages than specified in RateLimitBurst= are logged by a service, all further messages within the interval are dropped until the interval is over. A message about the number of dropped messages is generated. This rate limiting is applied per-service, so that two services which log do not interfere with each other's limits. Defaults to 1000 messages in 30s. The time specification for RateLimitInterval= may be specified in the following units: "s", "min", "h", "ms", "us". To turn off any kind of rate limiting, set either value to 0. ...

這里寫(xiě)了默認(rèn)30秒內(nèi)只能接收1000條日志，看到這里就能明白了，因?yàn)榍瓣囎觿傇赿ocker發(fā)布了一個(gè)單日日志文件大小差不多達(dá)到3G的服務(wù)，導(dǎo)致到了其他服務(wù)的日志也受到了影響，大量的日志被journald丟棄，所以我們修改一下配置就沒(méi)有問(wèn)題了。

打開(kāi)/etc/systemd/journald.conf文件，將RateLimitBurst從默認(rèn)的1000修改成5000，根據(jù)自己目前的日志輸出量進(jìn)行調(diào)整：

[root@ad-official log]# cat /etc/systemd/journald.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitInterval=30s
RateLimitBurst=5000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#MaxRetentionSec=
#MaxFileSec=1month
ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
ForwardToWall=no
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

順便將ForwardToSyslog和ForwardToWall設(shè)置成no，因?yàn)槟J(rèn)是yes，會(huì)導(dǎo)致我們清理了journal的日志文件，而Syslog中的沒(méi)有清除掉，慢慢的就會(huì)將磁盤(pán)占滿。

然后重啟一下journald就可以恢復(fù)正常使用啦：systemctl restart systemd-journald.service

以上就是本文的全部?jī)?nèi)容，希望對(duì)大家的學(xué)習(xí)有所幫助，也希望大家多多支持腳本之家。