0

When writing a message to /dev/kmsg while tailing /proc/kmsg the messages show up very randomly, in never shows up in /var/log/kern.log.

However, dmesg gets all the messages correctly.

Example

# Terminal 1
sudo tail -f /proc/kmsg

# Terminal 2 
tail -f /var/log/kern.log

# Terminal 3
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'
sudo sh -c 'echo "<1> Kernel log message" > /dev/kmsg'

Results:

# Terminal 1
# The message is shown at irregular intervals without a clear pattern
sudo tail -f /proc/kmsg
    <9>[37102.185491]  Kernel log message

# Terminal 2 
# No message is ever shown
tail -f /var/log/kern.log

# Terminal 4
# Everything is always here
dmesg
    [37101.556366]  Kernel log message
    [37102.185491]  Kernel log message
    [37103.042422]  Kernel log message

When plugging in an USB stick, the data gets randomly split between output from /proc/kmsg and /var/log/kern.log. dmesg again show all the messages.

  • What is dmesg doing differently from other approaches?
  • Why is it possible to just break rsyslog's kernel logging by having another process listen to /dev/kmsg. Why aren't my attempts blocked with device or resource busy?
  • Why doesn't rsyslog ever log the messages sent to /dev/kmsg even though they do occasionally reach proc/kmsg?
  • Don't understand why you mention /var/log/kern.log, it's not touched by the kernel, unlike the other two. – 炸鱼薯条德里克 Feb 26 at 10:05
2

/proc/kmsg is not shareable amongst log readers, and if there are multiple readers only one of them will receive any given log message. /dev/kmsg is shareable amongst multiple log readers, providing the whole log stream (pace underruns by slow readers) to each reader.

Further reading

  • Accepting the answer, basic question solved. If you have the knowledge of the historical context of why both exist and which serves which use case, that would be a great expansion of the answer. – TheMeaningfulEngineer Mar 15 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.