journalctl输出sshd服务最近启动以来的日志

journalctl 是一个用于查询和显示 systemd 日志的工具

1.查看服务启动状态

systemctl status sshd


[root@centos8-1 ~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2025-02-14 04:12:31 UTC; 3h 30min ago
     Docs: man:sshd(8)
           man:sshd_config(5)

注意： Active: active (running) since Fri 2025-02-14 04:12:31 UTC 启动时间点

2.输出sshd最近一次启动日志

journalctl -u sshd.service --no-pager --since "2025-02-14 04:12:31"

--no-pager 行输出换行完整输出

START_TIME=$(systemctl show -p ActiveEnterTimestamp --value sshd.service)
journalctl -u sshd.service --no-pager --since "$START_TIME"

systemctl show -p ActiveEnterTimestamp –value sshd.service 是一个用于提取 sshd 服务最近一次启动时间