mirror of https://github.com/mkerrisk/man-pages
251 lines
7.7 KiB
Groff
251 lines
7.7 KiB
Groff
.\" Copyright (C) 1995 Andries Brouwer (aeb@cwi.nl)
|
|
.\"
|
|
.\" Permission is granted to make and distribute verbatim copies of this
|
|
.\" manual provided the copyright notice and this permission notice are
|
|
.\" preserved on all copies.
|
|
.\"
|
|
.\" Permission is granted to copy and distribute modified versions of this
|
|
.\" manual under the conditions for verbatim copying, provided that the
|
|
.\" entire resulting derived work is distributed under the terms of a
|
|
.\" permission notice identical to this one.
|
|
.\"
|
|
.\" Since the Linux kernel and libraries are constantly changing, this
|
|
.\" manual page may be incorrect or out-of-date. The author(s) assume no
|
|
.\" responsibility for errors or omissions, or for damages resulting from
|
|
.\" the use of the information contained herein. The author(s) may not
|
|
.\" have taken the same level of care in the production of this manual,
|
|
.\" which is licensed free of charge, as they might when working
|
|
.\" professionally.
|
|
.\"
|
|
.\" Formatted or processed versions of this manual, if unaccompanied by
|
|
.\" the source, must acknowledge the copyright and authors of this work.
|
|
.\"
|
|
.\" Written 11 June 1995 by Andries Brouwer <aeb@cwi.nl>
|
|
.\" 2008-02-15, Jeremy Kerr <jk@ozlabs.org>
|
|
.\" Add info on command type 10; add details on types 6, 7, 8, & 9.
|
|
.\" 2008-02-15, Michael Kerrisk <mtk.manpages@gmail.com>
|
|
.\" Update LOG_BUF_LEN details; update RETURN VALUE section.
|
|
.\"
|
|
.TH SYSLOG 2 2008-02-15 "Linux" "Linux Programmer's Manual"
|
|
.SH NAME
|
|
syslog, klogctl \- read and/or clear kernel message ring buffer;
|
|
set console_loglevel
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.BI "int syslog(int " type ", char *" bufp ", int " len );
|
|
.B " /* No wrapper provided in glibc */"
|
|
.sp
|
|
/* The glibc interface */
|
|
.br
|
|
.B "#include <sys/klog.h>"
|
|
.sp
|
|
.BI "int klogctl(int " type ", char *" bufp ", int " len );
|
|
.fi
|
|
.SH DESCRIPTION
|
|
If you need the libc function
|
|
.BR syslog ()
|
|
(which talks to
|
|
.BR syslogd (8)),
|
|
then look at
|
|
.BR syslog (3).
|
|
The system call of this name is about controlling the kernel
|
|
.IR printk ()
|
|
buffer, and the glibc version is called
|
|
.BR klogctl ().
|
|
|
|
The \fItype\fP argument determines the action taken by this function.
|
|
|
|
Quoting from
|
|
.IR kernel/printk.c :
|
|
.nf
|
|
/*
|
|
* Commands to sys_syslog:
|
|
*
|
|
* 0 \-\- Close the log. Currently a NOP.
|
|
* 1 \-\- Open the log. Currently a NOP.
|
|
* 2 \-\- Read from the log.
|
|
* 3 \-\- Read all messages remaining in the ring buffer.
|
|
* 4 \-\- Read and clear all messages remaining in the ring buffer
|
|
* 5 \-\- Clear ring buffer.
|
|
* 6 \-\- Disable printk to console
|
|
* 7 \-\- Enable printk to console
|
|
* 8 \-\- Set level of messages printed to console
|
|
* 9 \-\- Return number of unread characters in the log buffer
|
|
* 10 \-\- Return size of the log buffer
|
|
*/
|
|
.fi
|
|
|
|
Only command types 3 and 10 are allowed to non-root processes.
|
|
Type 9 was added in 2.4.10; type 10 in 2.6.6.
|
|
.SS The kernel log buffer
|
|
The kernel has a cyclic buffer of length
|
|
.B LOG_BUF_LEN
|
|
in which messages given as arguments to the kernel function
|
|
.BR printk ()
|
|
are stored (regardless of their loglevel).
|
|
In early kernels,
|
|
.B LOG_BUF_LEN
|
|
had the value 4096;
|
|
from kernel 1.3.54, it was 8192;
|
|
from kernel 2.1.113 it was 16384;
|
|
since 2.4.23/2.6 the value is a kernel configuration option.
|
|
.\" Under "General setup" ==> "Kernel log buffer size"
|
|
.\" For 2.6, precisely the option seems to have appeared in 2.5.55.
|
|
In recent kernels the size can be queried with command type 10.
|
|
|
|
The call
|
|
.I "syslog(2,buf,len)"
|
|
waits until this kernel log buffer is non-empty, and then reads
|
|
at most \fIlen\fP bytes into the buffer \fIbuf\fP.
|
|
It returns
|
|
the number of bytes read.
|
|
Bytes read from the log disappear from
|
|
the log buffer: the information can only be read once.
|
|
This is the function executed by the kernel when a user program
|
|
reads
|
|
.IR /proc/kmsg .
|
|
|
|
The call
|
|
.I syslog(3,buf,len)
|
|
will read the last \fIlen\fP bytes from the log buffer (non-destructively),
|
|
but will not read more than was written into the buffer since the
|
|
last "clear ring buffer" command (which does not clear the buffer at all).
|
|
It returns the number of bytes read.
|
|
|
|
The call
|
|
.I syslog(4,buf,len)
|
|
does precisely the same, but also executes the "clear ring buffer" command.
|
|
|
|
The call
|
|
.I syslog(5,dummy,dummy)
|
|
executes just the "clear ring buffer" command.
|
|
(In each call where
|
|
.I buf
|
|
or
|
|
.I len
|
|
is shown as "dummy", the value of the argument is ignored by the call.)
|
|
|
|
The call
|
|
.I syslog(6,dummy,dummy)
|
|
sets the console log level to minimum, so that no messages are printed
|
|
to the console.
|
|
|
|
The call
|
|
.I syslog(7,dummy,dummy)
|
|
sets the console log level to default, so that messages are printed
|
|
to the console.
|
|
|
|
The call
|
|
.I syslog(8,dummy,level)
|
|
sets the console log level to
|
|
.IR level ,
|
|
which must be an integer between 1 and 8 (inclusive).
|
|
See the
|
|
.B loglevel
|
|
section for details.
|
|
|
|
The call
|
|
.I syslog(9,dummy,dummy)
|
|
returns the number of bytes currently available to be read
|
|
on the kernel log buffer.
|
|
|
|
The call
|
|
.I syslog(10,dummy,dummy)
|
|
returns the total size of the kernel log buffer.
|
|
.SS The loglevel
|
|
The kernel routine
|
|
.BR printk ()
|
|
will only print a message on the
|
|
console, if it has a loglevel less than the value of the variable
|
|
.IR console_loglevel .
|
|
This variable initially has the value
|
|
.B DEFAULT_CONSOLE_LOGLEVEL
|
|
(7), but is set to 10 if the
|
|
kernel command line contains the word "debug", and to 15 in case
|
|
of a kernel fault (the 10 and 15 are just silly, and equivalent to 8).
|
|
This variable is set (to a value in the range 1-8) by the call
|
|
.IR syslog(8,dummy,value) .
|
|
The calls
|
|
.I syslog(type,dummy,dummy)
|
|
with \fItype\fP equal to 6 or 7, set it to 1 (kernel panics only)
|
|
or 7 (all except debugging messages), respectively.
|
|
|
|
Every text line in a message has its own loglevel.
|
|
This level is
|
|
.I "DEFAULT_MESSAGE_LOGLEVEL \- 1"
|
|
(6) unless the line starts with <d>
|
|
where \fId\fP is a digit in the range 1-7, in which case the level
|
|
is \fId\fP.
|
|
The conventional meaning of the loglevel is defined in
|
|
.I <linux/kernel.h>
|
|
as follows:
|
|
|
|
.nf
|
|
#define KERN_EMERG "<0>" /* system is unusable */
|
|
#define KERN_ALERT "<1>" /* action must be taken immediately */
|
|
#define KERN_CRIT "<2>" /* critical conditions */
|
|
#define KERN_ERR "<3>" /* error conditions */
|
|
#define KERN_WARNING "<4>" /* warning conditions */
|
|
#define KERN_NOTICE "<5>" /* normal but significant condition */
|
|
#define KERN_INFO "<6>" /* informational */
|
|
#define KERN_DEBUG "<7>" /* debug-level messages */
|
|
.fi
|
|
.SH "RETURN VALUE"
|
|
For \fItype\fP equal to 2, 3, or 4, a successful call to
|
|
.BR syslog ()
|
|
returns the number
|
|
of bytes read.
|
|
For \fItype\fP 9,
|
|
.BR syslog ()
|
|
returns the number of bytes currently
|
|
available to be read on the kernel log buffer.
|
|
For \fItype\fP 10,
|
|
.BR syslog ()
|
|
returns the total size of the kernel log buffer.
|
|
For other values of \fItype\fP, 0 is returned on success.
|
|
|
|
In case of error, \-1 is returned,
|
|
and \fIerrno\fP is set to indicate the error.
|
|
.SH ERRORS
|
|
.TP
|
|
.B EINVAL
|
|
Bad parameters (e.g.,
|
|
bad
|
|
.IR type ;
|
|
or for
|
|
.I type
|
|
2, 3, or 4,
|
|
.I buf
|
|
is NULL,
|
|
or
|
|
.I len
|
|
is less than zero; or for
|
|
.I type
|
|
8, the
|
|
.I level
|
|
is outside the range 1 to 8).
|
|
.TP
|
|
.B EPERM
|
|
An attempt was made to change console_loglevel or clear the kernel
|
|
message ring buffer by a process without root permissions
|
|
(more precisely: without the
|
|
.B CAP_SYS_ADMIN
|
|
capability).
|
|
.TP
|
|
.B ERESTARTSYS
|
|
System call was interrupted by a signal; nothing was read.
|
|
(This can be seen only during a trace.)
|
|
.SH "CONFORMING TO"
|
|
This system call is Linux-specific and should not be used in programs
|
|
intended to be portable.
|
|
.SH NOTES
|
|
From the very start people noted that it is unfortunate that
|
|
a system call and a library routine of the same name are entirely
|
|
different animals.
|
|
In libc4 and libc5 the number of this call was defined by
|
|
.BR SYS_klog .
|
|
In glibc 2.0 the syscall is baptized
|
|
.BR klogctl ().
|
|
.SH "SEE ALSO"
|
|
.BR syslog (3)
|