syslog,  klogctl  -  read  and/or clear kernel message ring buffer; set console_loglevel

       /* The glibc interface */
       int klogctl(int type, char *bufp, int len); 
       /* The handcrafted system call */
       _syscall3(int, syslog, int, type, char *, bufp, int, len); 
       int syslog(int type, char *bufp, int len);

       libc function syslog(),  (talks  to  syslogd(8)), see syslog(3).  
       This system call is about controlling  the kernel printk()  buffer,  
                      the  glibc  version  is  called klogctl().
                                                        /* Quoting from kernel/printk.c:
          Commands to sys_syslog:
               0 -- Close the log.
               1 -- Open the log. 

               2 -- Read and clear from the log buffer.
       nonpriv 3 -- Read up to the last 4k of messages in the ring buffer.
               4 -- Read and clear last 4k of messages in the ring buffer

               5 -- Clear ring buffer.
               6 -- Disable printk's to console
               7 -- Enable printk's to console
               8 -- Set level of messages printed to console
               9 -- Return number of unread characters in the log buffer */

       Only  function  3  is  allowed  to non-root processes.  

       The kernel has a cyclic  buffer  of  length  LOG_BUF_LEN in which messages from 
       function printk() are stored (regardless of their loglevel).

       syslog  (2,buf,len)  waits  until  this kernel log buffer is nonempty, and then reads, 
       at most len, bytes  into  buf and returns  the  number  of  bytes read. 
       Bytes read are removed from the log buffer: the information can only be read  once. 
       This  is the  function  executed  by  the  kernel  when  a  user  program  reads /proc/kmsg.

       syslog (3,buf,len) reads the last len bytes from  the  log buffer (nondestructively), 
       up to  the last `clear ring buffer',  returns the number of bytes read.

       syslog (4,buf,len) executes `clear ring buffer' 

       syslog (5,dummy,idummy) executes `clear ring  buffer' 

       The loglevel
       printk() will only print a message on the console if it has  a  loglevel  less   
         than  console_loglevel     
        (initially DEFAULT_CONSOLE_LOGLEVEL (7), but set to 10 if
       the kernel commandline contains the word `debug', and to 15 in case  of
       a  kernel  fault  - the 10 and 15 are equivalent to 8).
       This variable is set (to a value in the range 1-8) by the  call  syslog (8,dummy,value).  
       The calls syslog (type,dummy,idummy) with type equal
       to 6 or 7, set it to 1 (kernel panics only) or 7 (all except  debugging messages), respectively.

       Every  text  line  in  a  message  has  its own loglevel. 
       This level is DEFAULT_MESSAGE_LOGLEVEL - 1 (6) unless the line starts with   where
       d  is  a digit in the range 1-7, in which case the level is d. 
        The conventional meaning of the loglevel is  defined  in    

       #define KERN_EMERG    ""  /* system is unusable               */
       #define KERN_ALERT    ""  /* action must be taken immediately */
       #define KERN_CRIT     ""  /* critical conditions              */
       #define KERN_ERR      ""  /* error conditions                 */
       #define KERN_WARNING  ""  /* warning conditions               */
       #define KERN_NOTICE   ""  /* normal but significant condition */
       #define KERN_INFO     ""  /* informational                    */
       #define KERN_DEBUG    ""  /* debug-level messages             */

       Error, -1 , and errno is set.  
        for type equal to 2, 3 or 4, syslog() returns the number of bytes read, and otherwise 0.

       EPERM  An attempt was made to change console_loglevel or clear the kernel message ring buffer by a process without root permissions.

       EINVAL Bad parameters.

       ERESTARTSYS System call was interrupted by a  signal  -  nothing  was  read.
              (This is only during a trace.)

       This  system  call is Linux specific and should not be used in programs intended to be portable.

       kernel call  and  library routine of the same name are entirely different .  
       In libc4 and libc5 the  number  of  this  call  was  defined  by SYS_klog.  
        In glibc 2.0 the syscall is klogctl.