mirror of https://github.com/mkerrisk/man-pages
312 lines
9.1 KiB
Groff
312 lines
9.1 KiB
Groff
.\" Copyright (C) 1995 Andries Brouwer (aeb@cwi.nl)
|
|
.\"
|
|
.\" %%%LICENSE_START(VERBATIM)
|
|
.\" Permission is granted to make and distribute verbatim copies of this
|
|
.\" manual provided the copyright notice and this permission notice are
|
|
.\" preserved on all copies.
|
|
.\"
|
|
.\" Permission is granted to copy and distribute modified versions of this
|
|
.\" manual under the conditions for verbatim copying, provided that the
|
|
.\" entire resulting derived work is distributed under the terms of a
|
|
.\" permission notice identical to this one.
|
|
.\"
|
|
.\" Since the Linux kernel and libraries are constantly changing, this
|
|
.\" manual page may be incorrect or out-of-date. The author(s) assume no
|
|
.\" responsibility for errors or omissions, or for damages resulting from
|
|
.\" the use of the information contained herein. The author(s) may not
|
|
.\" have taken the same level of care in the production of this manual,
|
|
.\" which is licensed free of charge, as they might when working
|
|
.\" professionally.
|
|
.\"
|
|
.\" Formatted or processed versions of this manual, if unaccompanied by
|
|
.\" the source, must acknowledge the copyright and authors of this work.
|
|
.\" %%%LICENSE_END
|
|
.\"
|
|
.\" Written 11 June 1995 by Andries Brouwer <aeb@cwi.nl>
|
|
.\" 2008-02-15, Jeremy Kerr <jk@ozlabs.org>
|
|
.\" Add info on command type 10; add details on types 6, 7, 8, & 9.
|
|
.\" 2008-02-15, Michael Kerrisk <mtk.manpages@gmail.com>
|
|
.\" Update LOG_BUF_LEN details; update RETURN VALUE section.
|
|
.\"
|
|
.TH SYSLOG 2 2012-11-29 "Linux" "Linux Programmer's Manual"
|
|
.SH NAME
|
|
syslog, klogctl \- read and/or clear kernel message ring buffer;
|
|
set console_loglevel
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.BI "int syslog(int " type ", char *" bufp ", int " len );
|
|
.B " /* No wrapper provided in glibc */"
|
|
.sp
|
|
/* The glibc interface */
|
|
.br
|
|
.B "#include <sys/klog.h>"
|
|
.sp
|
|
.BI "int klogctl(int " type ", char *" bufp ", int " len );
|
|
.fi
|
|
.SH DESCRIPTION
|
|
If you need the C library function
|
|
.BR syslog ()
|
|
(which talks to
|
|
.BR syslogd (8)),
|
|
then look at
|
|
.BR syslog (3).
|
|
The system call of this name is about controlling the kernel
|
|
.IR printk ()
|
|
buffer, and the glibc wrapper function is called
|
|
.BR klogctl ().
|
|
.SS The kernel log buffer
|
|
The kernel has a cyclic buffer of length
|
|
.B LOG_BUF_LEN
|
|
in which messages given as arguments to the kernel function
|
|
.BR printk ()
|
|
are stored (regardless of their loglevel).
|
|
In early kernels,
|
|
.B LOG_BUF_LEN
|
|
had the value 4096;
|
|
from kernel 1.3.54, it was 8192;
|
|
from kernel 2.1.113 it was 16384;
|
|
since 2.4.23/2.6 the value is a kernel configuration option
|
|
.RB ( CONFIG_LOG_BUF_SHIFT ).
|
|
.\" Under "General setup" ==> "Kernel log buffer size"
|
|
.\" For 2.6, precisely the option seems to have appeared in 2.5.55.
|
|
In recent kernels the size can be queried with command type 10 (see below).
|
|
.SS Commands
|
|
The \fItype\fP argument determines the action taken by this function.
|
|
The list below specifies the values for
|
|
.IR type .
|
|
The symbolic names are defined in the kernel source,
|
|
but are not exported to user space;
|
|
you will either need to use the numbers, or define the names yourself.
|
|
.TP
|
|
.BR SYSLOG_ACTION_CLOSE " (0)"
|
|
Close the log.
|
|
Currently a NOP.
|
|
.TP
|
|
.BR SYSLOG_ACTION_OPEN " (1)"
|
|
Open the log.
|
|
Currently a NOP.
|
|
.TP
|
|
.BR SYSLOG_ACTION_READ " (2)"
|
|
Read from the log.
|
|
The call
|
|
waits until the kernel log buffer is nonempty, and then reads
|
|
at most \fIlen\fP bytes into the buffer pointed to by
|
|
.IR bufp .
|
|
The call returns the number of bytes read.
|
|
Bytes read from the log disappear from the log buffer:
|
|
the information can be read only once.
|
|
This is the function executed by the kernel when a user program reads
|
|
.IR /proc/kmsg .
|
|
.TP
|
|
.BR SYSLOG_ACTION_READ_ALL " (3)"
|
|
Read all messages remaining in the ring buffer,
|
|
placing then in the buffer pointed to by
|
|
.IR bufp .
|
|
The call reads the last \fIlen\fP
|
|
bytes from the log buffer (nondestructively),
|
|
but will not read more than was written into the buffer since the
|
|
last "clear ring buffer" command (see command 5 below)).
|
|
The call returns the number of bytes read.
|
|
.TP
|
|
.BR SYSLOG_ACTION_READ_CLEAR " (4)"
|
|
Read and clear all messages remaining in the ring buffer.
|
|
The call does precisely the same as for a
|
|
.I type
|
|
of 3, but also executes the "clear ring buffer" command.
|
|
.TP
|
|
.BR SYSLOG_ACTION_CLEAR " (5)"
|
|
The call executes just the "clear ring buffer" command.
|
|
The
|
|
.I bufp
|
|
and
|
|
.I len
|
|
arguments are ignored.
|
|
.IP
|
|
This command does not really clear the ring buffer.
|
|
Rather, it sets a kernel bookkeeping variable that
|
|
determines the results returned by commands 3
|
|
.RB ( SYSLOG_ACTION_READ_ALL )
|
|
and 4
|
|
.RB ( SYSLOG_ACTION_READ_CLEAR ).
|
|
This command has no effect on commands 2
|
|
.RB ( SYSLOG_ACTION_READ )
|
|
and 9
|
|
.RB ( SYSLOG_ACTION_SIZE_UNREAD ).
|
|
.TP
|
|
.BR SYSLOG_ACTION_CONSOLE_OFF " (6)"
|
|
Disable printk to console.
|
|
The call sets the console log level to the minimum,
|
|
so that no messages are printed to the console.
|
|
The
|
|
.I bufp
|
|
and
|
|
.I len
|
|
arguments are ignored.
|
|
.TP
|
|
.BR SYSLOG_ACTION_CONSOLE_ON " (7)"
|
|
The call sets the console log level to the default,
|
|
so that messages are printed to the console.
|
|
The
|
|
.I bufp
|
|
and
|
|
.I len
|
|
arguments are ignored.
|
|
.TP
|
|
.BR SYSLOG_ACTION_CONSOLE_LEVEL " (8)"
|
|
The call sets the console log level to the value given in
|
|
.IR len ,
|
|
which must be an integer between 1 and 8 (inclusive).
|
|
See the
|
|
.B loglevel
|
|
section for details.
|
|
The
|
|
.I bufp
|
|
argument is ignored.
|
|
.TP
|
|
.BR SYSLOG_ACTION_SIZE_UNREAD " (9) (since Linux 2.4.10)"
|
|
The call
|
|
returns the number of bytes currently available to be read
|
|
from the kernel log buffer via command 2
|
|
.RB ( SYSLOG_ACTION_READ ).
|
|
The
|
|
.I bufp
|
|
and
|
|
.I len
|
|
arguments are ignored.
|
|
.TP
|
|
.BR SYSLOG_ACTION_SIZE_BUFFER " (10) (since Linux 2.6.6)"
|
|
This command returns the total size of the kernel log buffer.
|
|
The
|
|
.I bufp
|
|
and
|
|
.I len
|
|
arguments are ignored.
|
|
.PP
|
|
All commands except 3 and 10 require privilege.
|
|
In Linux kernels before 2.6.37,
|
|
command types 3 and 10 are allowed to unprivileged processes;
|
|
since Linux 2.6.37,
|
|
these commands are allowed to unprivileged processes only if
|
|
.IR /proc/sys/kernel/dmesg_restrict
|
|
has the value 0.
|
|
Before Linux 2.6.37, "privileged" means that the caller has the
|
|
.BR CAP_SYS_ADMIN
|
|
capability.
|
|
Since Linux 2.6.37,
|
|
"privileged" means that the caller has either the
|
|
.BR CAP_SYS_ADMIN
|
|
capability (now deprecated for this purpose) or the (new)
|
|
.BR CAP_SYSLOG
|
|
capability.
|
|
.SS The loglevel
|
|
The kernel routine
|
|
.BR printk ()
|
|
will only print a message on the
|
|
console, if it has a loglevel less than the value of the variable
|
|
.IR console_loglevel .
|
|
This variable initially has the value
|
|
.B DEFAULT_CONSOLE_LOGLEVEL
|
|
(7), but is set to 10 if the
|
|
kernel command line contains the word "debug", and to 15 in case
|
|
of a kernel fault (the 10 and 15 are just silly, and equivalent to 8).
|
|
This variable is set (to a value in the range 1-8) by a
|
|
.BR syslog ()
|
|
call with a
|
|
.I type
|
|
of 8.
|
|
Calls to
|
|
.BR syslog ()
|
|
with
|
|
.I type
|
|
equal to 6 or 7 set the variable to 1 (kernel panics only)
|
|
or 7 (all except debugging messages), respectively.
|
|
|
|
Every text line in a message has its own loglevel.
|
|
This level is
|
|
.I "DEFAULT_MESSAGE_LOGLEVEL \- 1"
|
|
(6) unless the line starts with <d>
|
|
where \fId\fP is a digit in the range 1-7, in which case the level
|
|
is \fId\fP.
|
|
The conventional meaning of the loglevel is defined in
|
|
.I <linux/kernel.h>
|
|
as follows:
|
|
|
|
.nf
|
|
#define KERN_EMERG "<0>" /* system is unusable */
|
|
#define KERN_ALERT "<1>" /* action must be taken immediately */
|
|
#define KERN_CRIT "<2>" /* critical conditions */
|
|
#define KERN_ERR "<3>" /* error conditions */
|
|
#define KERN_WARNING "<4>" /* warning conditions */
|
|
#define KERN_NOTICE "<5>" /* normal but significant condition */
|
|
#define KERN_INFO "<6>" /* informational */
|
|
#define KERN_DEBUG "<7>" /* debug-level messages */
|
|
.fi
|
|
.SH RETURN VALUE
|
|
For \fItype\fP equal to 2, 3, or 4, a successful call to
|
|
.BR syslog ()
|
|
returns the number
|
|
of bytes read.
|
|
For \fItype\fP 9,
|
|
.BR syslog ()
|
|
returns the number of bytes currently
|
|
available to be read on the kernel log buffer.
|
|
For \fItype\fP 10,
|
|
.BR syslog ()
|
|
returns the total size of the kernel log buffer.
|
|
For other values of \fItype\fP, 0 is returned on success.
|
|
|
|
In case of error, \-1 is returned,
|
|
and \fIerrno\fP is set to indicate the error.
|
|
.SH ERRORS
|
|
.TP
|
|
.B EINVAL
|
|
Bad arguments (e.g.,
|
|
bad
|
|
.IR type ;
|
|
or for
|
|
.I type
|
|
2, 3, or 4,
|
|
.I buf
|
|
is NULL,
|
|
or
|
|
.I len
|
|
is less than zero; or for
|
|
.I type
|
|
8, the
|
|
.I level
|
|
is outside the range 1 to 8).
|
|
.TP
|
|
.B ENOSYS
|
|
This
|
|
.BR syslog ()
|
|
system call is not available, because the kernel was compiled with the
|
|
.BR CONFIG_PRINTK
|
|
kernel-configuration option disabled.
|
|
.TP
|
|
.B EPERM
|
|
An attempt was made to change console_loglevel or clear the kernel
|
|
message ring buffer by a process without sufficient privilege
|
|
(more precisely: without the
|
|
.B CAP_SYS_ADMIN
|
|
or
|
|
.BR CAP_SYSLOG
|
|
capability).
|
|
.TP
|
|
.B ERESTARTSYS
|
|
System call was interrupted by a signal; nothing was read.
|
|
(This can be seen only during a trace.)
|
|
.SH CONFORMING TO
|
|
This system call is Linux-specific and should not be used in programs
|
|
intended to be portable.
|
|
.SH NOTES
|
|
From the very start people noted that it is unfortunate that
|
|
a system call and a library routine of the same name are entirely
|
|
different animals.
|
|
.\" In libc4 and libc5 the number of this call was defined by
|
|
.\" .BR SYS_klog .
|
|
.\" In glibc 2.0 the syscall is baptized
|
|
.\" .BR klogctl ().
|
|
.SH SEE ALSO
|
|
.BR syslog (3),
|
|
.BR capabilities (7)
|