I am using syslog to read kernel log messages with SYSLOG_ACTION_READ.

I would like to know if it's possible to "obtain" a file descriptor to "something" that would send the kernel logs (like what syslog provides). Indeed, I would like to use select to watch this file descriptor in my application (since I am already watching other udev-related file descriptors)

Moreover, I would like to know if there is room for configuration (like setting the log level, formatting the timestamp in human-readable form).

If any or all of my requirement are not possible, what kind of approach would you recommend?

  • 1
    Kernel messages can be read from /dev/kmsg, at least on Linux. Sep 17, 2015 at 18:30

1 Answer 1


Run strace dmesg to see what it's reading.

# strace -e '!read,write' dmesg >/dev/null
open("/dev/kmsg", O_RDONLY|O_NONBLOCK)  = 3

There are no parameters to change the format or filter messages, that's the job of the program that reads from that device.

If you have syslog running, it would make sense to watch the log that it emits (you can make it log to a pipe), rather than directly read the kernel logs.

  • Thanks, it works out. I'm adding a lseek(fd, 0, SEEK_END) just after the open to only fetch the new messages occurring from that time onwards. I can properly consume the new messages as they come, which is what I want. A simple question, though: is there any problem when "log rotation" occurs?
    – mamahuhu
    Sep 18, 2015 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.