what is the actual use of /dev/log, while googling it I understand it is used for logging from userspace to Syslog. I thought /dev/kmsg is used for that role. Am I missing anything?


test@test:~$ cat /dev/log
cat: /dev/log: No such device or address
  • /dev/log is (or is a symbolic link to) an AF_LOCAL datagram socket, which applications are expected to send datagrams to, not read stream data from with cat. It is a convention of C libraries, and their library functions such as the syslog() function, and not a part of Linux itself. It's readers will be a dæmon such as syslog-read, one of the syslog variants, or systemd-journald.
  • /dev/kmsg is a stream device that is a part of Linux, presenting the contents of Linux's circular message buffer, which applications are expected to read from in order to obtain kernel log data; and not really write to in normal circumstances. The normal readers are the dmesg program and a dæmon such as klog-read, klogd, one of the syslog variants, or systemd-journald.

Further reading


It's described in man syslogd:

          The Unix domain socket to from where local syslog messages are read.

You can see yourself that it's used by syslogd using logger command for example:

$ strace -f logger a 2>&1 | grep  /dev/log
connect(3, {sa_family=AF_UNIX, sun_path="/dev/log"}, 110) = 0

Or lsof (if available):

$ sudo lsof /dev/log
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /home/ja/.cache/gvfs
      Output information may be incomplete.
syslogd 860 root    0u  unix 0x0000000003d863fa      0t0 18404 /dev/log type=DGRAM

Notice that there are multiple implementations of syslogd on various systems - Slackware for example comes with sysklogd but various embedded platforms come with their own implementation such as Busybox.

I believe you might also confuse syslog(2) and syslog(3):

$ man -k syslog | grep '^syslog '
syslog (2)           - read and/or clear kernel message ring buffer; set console_loglevel
syslog (3)           - send messages to the system logger

syslog(2) is a syscall (also listed in man syscalls) used by dmesg through libc klogctl API to read and/or clear kernel message ring buffer while syslog(3) is used to send messages to syslogd. These 2 functions are named the same but they are used for completely different purposes and work differently internally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.