52

I often saw the words "kernel ring buffer", "user level", "log level" and some other words appear together. e.g.

/var/log/dmesg Contains kernel ring buffer information.

/var/log/kern.log Contains only the kernel's messages of any loglevel

/var/log/user.log Contains information about all user level logs

Are they all about logs? How are they related and different?

By "level", I would imagine a hierarchy of multiple levels?

Is "user level" related to "user space"?

Are they related to runlevel or protection ring in some way?

Improve this question
53

Yes, all of this has to do with logging. No, none of it has to do with runlevel or "protection ring".

The kernel keeps its logs in a ring buffer. The main reason for this is so that the logs from the system startup get saved until the syslog daemon gets a chance to start up and collect them. Otherwise there would be no record of any logs prior to the startup of the syslog daemon. The contents of that ring buffer can be seen at any time using the dmesg command, and its contents are also saved to /var/log/dmesg just as the syslog daemon is starting up.

All logs that do not come from the kernel are sent as they are generated to the syslog daemon so they are not kept in any buffers. The kernel logs are also picked up by the syslog daemon as they are generated but they also continue to be saved (unnecessarily, arguably) to the ring buffer.

The log levels can be seen documented in the syslog(3) manpage and are as follows:

  • LOG_EMERG: system is unusable
  • LOG_ALERT: action must be taken immediately
  • LOG_CRIT: critical conditions
  • LOG_ERR: error conditions
  • LOG_WARNING: warning conditions
  • LOG_NOTICE: normal, but significant, condition
  • LOG_INFO: informational message
  • LOG_DEBUG: debug-level message

Each level is designed to be less "important" than the previous one. A log file that records logs at one level will also record logs at all of the more important levels too.

The difference between /var/log/kern.log and /var/log/mail.log (for example) is not to do with the level but with the facility, or category. The categories are also documented on the manpage.

Improve this answer
6
  • Thanks. (1) Is "user level" related to "user space"? (2) From what you said, /var/log/kern.log and /var/log/dmesg should have the same content as the kernel messages? But their contents are not the same. – Tim Apr 23 '15 at 18:07
  • "user level" isn't a thing, as far as I know. There is the syslog level, which is the "importance" level of a syslog message (I listed the levels), and it doesn't have anything to do with user space vs. kernel space. /var/log/kern.log should contain the dmesg content (perhaps formatted differently) from boot time. Unless it has been a long time since boot and those contents have been rotated out. – Celada Apr 23 '15 at 19:16
  • My second question is: While dmesg prints out the current values of kernel ring buffer, the past/old values of the buffer are stored in /var/log/dmesg. So dmesg output is just a recent subset of /var/log/dmesg content, and they are different. Then are the contents of /var/log/dmesg (not dmesg as in your comment) and /var/log/kernel.log the same? – Tim Apr 23 '15 at 20:35
  • Depends when! Soon after boot, the /var/log/dmesg content will likely be near the end of /var/log/kern.log. Much later on, it won't be there, it will have rotated out. In general, /var/log/kern.log will contain logs that are older than any given snapshot of the kernel's log ring buffer and also logs that are newer than the snapshot. – Celada Apr 23 '15 at 23:25
  • 2
    This video explains the circular buffer pretty well – Alex W Nov 21 '15 at 3:51
23

To answer at least the first part of your question about dmesg:

/var/log/dmesg stores the content of the 'kernel ring buffer', a memory buffer created by the kernel at boot in which to store log data it generates as soon as you get past the bootloader phase.

A ring buffer is a special kind of buffer that is always a constant size, removing the oldest messages when new messages come in. The text stored in the kernel ring buffer is what you see flashing past you on-screen when you first boot a Unix-like machine in console mode (no splash screen, Plymouth). The kernel log is stored in a memory buffer so that boot logs have somewhere to be, until the system has bootstrapped itself to the point where the syslog daemon can take over.

dmesg under Linux is a part of the essential util-linux package of system maintenance tools published by kernel.org. According to the dmesg(1) man page,

dmesg is used to examine or control the kernel ring buffer.

See: http://www.computerhope.com/unix/dmesg.htm

Under 'systemd' init, this command can be used to print the kernel ring buffer:
# journalctl --dmesg or journalctl -k, thxs for correction @don_crissti

Issuing the command dmesg | grep -i ethernet for example, will parse the kernel ring buffer for the string 'ethernet'.

I hope this helps at least with the first part of your inquiry.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.