syslog, klogctl - read and/or clear kernel message ring buffer; set console_loglevel
/* The glibc interface */
int klogctl(int type, char *bufp, int len);
/* The handcrafted system call */
_syscall3(int, syslog, int, type, char *, bufp, int, len);
int syslog(int type, char *bufp, int len);
libc function syslog(), (talks to syslogd(8)), see syslog(3).
This system call is about controlling the kernel printk() buffer,
the glibc version is called klogctl().
/* Quoting from kernel/printk.c:
Commands to sys_syslog:
0 -- Close the log.
1 -- Open the log.
2 -- Read and clear from the log buffer.
nonpriv 3 -- Read up to the last 4k of messages in the ring buffer.
4 -- Read and clear last 4k of messages in the ring buffer
5 -- Clear ring buffer.
6 -- Disable printk's to console
7 -- Enable printk's to console
8 -- Set level of messages printed to console
9 -- Return number of unread characters in the log buffer */
Only function 3 is allowed to non-root processes.
The kernel has a cyclic buffer of length LOG_BUF_LEN in which messages from
function printk() are stored (regardless of their loglevel).
syslog (2,buf,len) waits until this kernel log buffer is nonempty, and then reads,
at most len, bytes into buf and returns the number of bytes read.
Bytes read are removed from the log buffer: the information can only be read once.
This is the function executed by the kernel when a user program reads /proc/kmsg.
syslog (3,buf,len) reads the last len bytes from the log buffer (nondestructively),
up to the last `clear ring buffer', returns the number of bytes read.
syslog (4,buf,len) executes `clear ring buffer'
syslog (5,dummy,idummy) executes `clear ring buffer'
printk() will only print a message on the console if it has a loglevel less
(initially DEFAULT_CONSOLE_LOGLEVEL (7), but set to 10 if
the kernel commandline contains the word `debug', and to 15 in case of
a kernel fault - the 10 and 15 are equivalent to 8).
This variable is set (to a value in the range 1-8) by the call syslog (8,dummy,value).
The calls syslog (type,dummy,idummy) with type equal
to 6 or 7, set it to 1 (kernel panics only) or 7 (all except debugging messages), respectively.
Every text line in a message has its own loglevel.
This level is DEFAULT_MESSAGE_LOGLEVEL - 1 (6) unless the line starts with where
d is a digit in the range 1-7, in which case the level is d.
The conventional meaning of the loglevel is defined in
#define KERN_EMERG "" /* system is unusable */
#define KERN_ALERT "" /* action must be taken immediately */
#define KERN_CRIT "" /* critical conditions */
#define KERN_ERR "" /* error conditions */
#define KERN_WARNING "" /* warning conditions */
#define KERN_NOTICE "" /* normal but significant condition */
#define KERN_INFO "" /* informational */
#define KERN_DEBUG "" /* debug-level messages */
Error, -1 , and errno is set.
for type equal to 2, 3 or 4, syslog() returns the number of bytes read, and otherwise 0.
EPERM An attempt was made to change console_loglevel or clear the kernel message ring buffer by a process without root permissions.
EINVAL Bad parameters.
ERESTARTSYS System call was interrupted by a signal - nothing was read.
(This is only during a trace.)
This system call is Linux specific and should not be used in programs intended to be portable.
kernel call and library routine of the same name are entirely different .
In libc4 and libc5 the number of this call was defined by SYS_klog.
In glibc 2.0 the syscall is klogctl.