what is the actual use of /dev/log, while googling it I understand it is used for logging from userspace to Syslog. I thought /dev/kmsg is used for that role. Am I missing anything?
Note:
test@test:~$ cat /dev/log
cat: /dev/log: No such device or address
It's described in man syslogd:
/dev/log The Unix domain socket to from where local syslog messages are read.
You can see yourself that it's used by syslogd using logger command for example:
$ strace -f logger a 2>&1 | grep /dev/log
connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0
Or lsof (if available):
$ sudo lsof /dev/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /home/ja/.cache/gvfs
Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 860 root 0u unix 0x0000000003d863fa 0t0 18404 /dev/log type=DGRAM
Notice that there are multiple implementations of syslogd on various
systems - Slackware for example comes with sysklogd but various
embedded platforms come with their own implementation such as Busybox.
I believe you might also confuse syslog(2) and syslog(3):
$ man -k syslog | grep '^syslog '
syslog (2) - read and/or clear kernel message ring buffer; set console_loglevel
syslog (3) - send messages to the system logger
syslog(2) is a syscall (also listed in man syscalls) used by
dmesg through libc klogctl API to read and/or clear kernel
message ring buffer while syslog(3) is used to send messages to
syslogd. These 2 functions are named the same but they are used for
completely different purposes and work differently internally.
/dev/log is (or is a symbolic link to) an AF_LOCAL datagram socket, which applications are expected to send datagrams to, not read stream data from with cat. It is a convention of C libraries, and their library functions such as the syslog() function, and not a part of Linux itself. It's readers will be a dæmon such as syslog-read, one of the syslog variants, or systemd-journald./dev/kmsg is a stream device that is a part of Linux, presenting the contents of Linux's circular message buffer, which applications are expected to read from in order to obtain kernel log data; and not really write to in normal circumstances. The normal readers are the dmesg program and a dæmon such as klog-read, klogd, one of the syslog variants, or systemd-journald.