1syslog(2) System Calls Manual syslog(2)
2
6 syslog, klogctl - read and/or clear kernel message ring buffer; set
7 console_loglevel
8
10 Standard C library (libc, -lc)
11
13 #include <sys/klog.h> /* Definition of SYSLOG_* constants */
14 #include <sys/syscall.h> /* Definition of SYS_* constants */
15 #include <unistd.h>
16 int syscall(SYS_syslog, int type, char *bufp, int len);
18 /* The glibc interface */
20 #include <sys/klog.h>
21 int klogctl(int type, char *bufp, int len);
23
25 Note: Probably, you are looking for the C library function syslog(),
26 which talks to syslogd(8); see syslog(3) for details.
27 This page describes the kernel syslog() system call, which is used to
29 control the kernel printk() buffer; the glibc wrapper function for the
30 system call is called klogctl().
31 The kernel log buffer
33 The kernel has a cyclic buffer of length LOG_BUF_LEN in which messages
34 given as arguments to the kernel function printk() are stored (regard‐
35 less of their log level). In early kernels, LOG_BUF_LEN had the value
36 4096; from Linux 1.3.54, it was 8192; from Linux 2.1.113, it was 16384;
37 since Linux 2.4.23/2.6, the value is a kernel configuration option
38 (CONFIG_LOG_BUF_SHIFT, default value dependent on the architecture).
39 Since Linux 2.6.6, the size can be queried with command type 10 (see
40 below).
41 Commands
43 The type argument determines the action taken by this function. The
44 list below specifies the values for type. The symbolic names are de‐
45 fined in the kernel source, but are not exported to user space; you
46 will either need to use the numbers, or define the names yourself.
47 SYSLOG_ACTION_CLOSE (0)
49 Close the log. Currently a NOP.
50 SYSLOG_ACTION_OPEN (1)
52 Open the log. Currently a NOP.
53 SYSLOG_ACTION_READ (2)
55 Read from the log. The call waits until the kernel log buffer
56 is nonempty, and then reads at most len bytes into the buffer
57 pointed to by bufp. The call returns the number of bytes read.
58 Bytes read from the log disappear from the log buffer: the in‐
59 formation can be read only once. This is the function executed
60 by the kernel when a user program reads /proc/kmsg.
61 SYSLOG_ACTION_READ_ALL (3)
63 Read all messages remaining in the ring buffer, placing them in
64 the buffer pointed to by bufp. The call reads the last len
65 bytes from the log buffer (nondestructively), but will not read
66 more than was written into the buffer since the last "clear ring
67 buffer" command (see command 5 below)). The call returns the
68 number of bytes read.
69 SYSLOG_ACTION_READ_CLEAR (4)
71