1

what is the actual use of /dev/log, while googling it I understand it is used for logging from userspace to Syslog. I thought /dev/kmsg is used for that role. Am I missing anything?

Note:

test@test:~$ cat /dev/log
cat: /dev/log: No such device or address
Karthik Nedunchezhiyan
  • 777

2 Answers2

1

It's described in man syslogd:

   /dev/log
          The Unix domain socket to from where local syslog messages are read.

You can see yourself that it's used by syslogd using logger command for example:

$ strace -f logger a 2>&1 | grep  /dev/log
connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0

Or lsof (if available):

$ sudo lsof /dev/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /home/ja/.cache/gvfs
      Output information may be incomplete.
COMMAND PID USER   FD   TYPE             DEVICE SIZE/OFF  NODE NAME
syslogd 860 root    0u  unix 0x0000000003d863fa      0t0 18404 /dev/log type=DGRAM

Notice that there are multiple implementations of syslogd on various systems - Slackware for example comes with sysklogd but various embedded platforms come with their own implementation such as Busybox.

I believe you might also confuse syslog(2) and syslog(3):

$ man -k syslog | grep '^syslog '
syslog (2)           - read and/or clear kernel message ring buffer; set console_loglevel
syslog (3)           - send messages to the system logger

syslog(2) is a syscall (also listed in man syscalls) used by dmesg through libc klogctl API to read and/or clear kernel message ring buffer while syslog(3) is used to send messages to syslogd. These 2 functions are named the same but they are used for completely different purposes and work differently internally.

Arkadiusz Drabczyk
  • 25,539
1
  • /dev/log is (or is a symbolic link to) an AF_LOCAL datagram socket, which applications are expected to send datagrams to, not read stream data from with cat. It is a convention of C libraries, and their library functions such as the syslog() function, and not a part of Linux itself. It's readers will be a dæmon such as syslog-read, one of the syslog variants, or systemd-journald.
  • /dev/kmsg is a stream device that is a part of Linux, presenting the contents of Linux's circular message buffer, which applications are expected to read from in order to obtain kernel log data; and not really write to in normal circumstances. The normal readers are the dmesg program and a dæmon such as klog-read, klogd, one of the syslog variants, or systemd-journald.

Further reading

JdeBP
  • 68,745