3

When writing a message to /dev/kmsg while tailing /proc/kmsg the messages show up very randomly, in never shows up in /var/log/kern.log.

However, dmesg gets all the messages correctly.

Example

# Terminal 1
sudo tail -f /proc/kmsg

# Terminal 2 
tail -f /var/log/kern.log

# Terminal 3
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'

Results:

# Terminal 1
# The message is shown at irregular intervals without a clear pattern
sudo tail -f /proc/kmsg
    <9>[37102.185491]  Kernel log message

# Terminal 2 
# No message is ever shown
tail -f /var/log/kern.log

# Terminal 4
# Everything is always here
dmesg
    [37101.556366]  Kernel log message
    [37102.185491]  Kernel log message
    [37103.042422]  Kernel log message

When plugging in an USB stick, the data gets randomly split between output from /proc/kmsg and /var/log/kern.log. dmesg again show all the messages.

  • What is dmesg doing differently from other approaches?
  • Why is it possible to just break rsyslog's kernel logging by having another process listen to /dev/kmsg. Why aren't my attempts blocked with device or resource busy?
  • Why doesn't rsyslog ever log the messages sent to /dev/kmsg even though they do occasionally reach proc/kmsg?
1
  • Don't understand why you mention /var/log/kern.log, it's not touched by the kernel, unlike the other two. Feb 26, 2019 at 10:05

1 Answer 1

7

/proc/kmsg is not shareable amongst log readers, and if there are multiple readers only one of them will receive any given log message. /dev/kmsg is shareable amongst multiple log readers, providing the whole log stream (pace underruns by slow readers) to each reader.

Further reading

1
  • Accepting the answer, basic question solved. If you have the knowledge of the historical context of why both exist and which serves which use case, that would be a great expansion of the answer. Mar 15, 2019 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .