Are the ring buffer, the queue of messages, and the write buffer the same? If not, how do ring buffer, queue and write buffer work together in syslogd or rsyslogd?

  • Most implementations of syslogd queue messages for a short time, and handle duplicate messages which arrive at the queue during this period.

  • A sync to the disk on each write to the file can be delayed for faster writes, by - preceding the filename in /etc/syslog.conf, for example *.debug;mail.none;news.none -/var/log/messages

When syslogd or rsyslogd writes new logs into the ring buffer, does it also write the same new logs to file /var/log/syslog? At any time, is the content of the ring buffer always part of the content of file /var/log/syslog, or can it be ahead of the file and make the content of the file outdated?

1 Answer 1


The "ring buffer" is used to log early messages, the ones that are issued before whichever syslog daemon starts. It's a concept adopted from real-time Operating Systems.

The ring buffer data structure is simply a (pre-allocated) area of kernel memory, plus a couple of pointers. It's available for logging the instant the kernel starts. It needs exactly no resource allocation, doesn't count on anything being working already. If "something goes wrong" in system startup (to the point where rsyslogd doesn't start), dmesg will show these early messages, which might help.

When the Syslog daemon starts, it reads the ring buffer, and produces/processes the log entries.

Later, when the system is up and running, the syslog daemon does regular, buffered, disk I/O, writing to log files, synchronizing after each write (see man 3 fflush). If, however, one prefaces the log filename with "-", the synchronization is left to the disk buffering scheme.

  • Thanks. Later, when the system is up and running, are the ring buffer and the write buffer two unrelated buffers in the kernel space? Does syslogd write new log messages to both /var/log/syslog file (via the write buffer) and the ring buffer? Is there an order between new log messages written to the ring buffer and to /var/log/syslog file?
    – Ben
    Apr 1, 2021 at 20:13
  • Where does syslogd queue log messages?
    – Ben
    Apr 1, 2021 at 20:13
  • AFAIK, messages are not queued, just written to disk, using the disk filesystem's queuing. Why would it queue messages? The goal is to move the messages to disk so they'll be preserved across the next reboot. And there WILL be a next reboot.
    – waltinator
    Apr 6, 2021 at 3:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .