Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the purposes of kernel logging, why do I have three different, non-inclusive levels of logging amongst /var/log/messages, /var/log/syslog, and /var/log/kern.log?

share|improve this question
up vote 28 down vote accepted

Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under /var/log. In some datacenter setups there are hundreds of devices each with its own log; syslog comes here handy too. One just sets up a dedicated syslog server which collects all the individual device logs over the network. Syslog can also save logs to databases, and other stuff.

According to my /etc/syslog.conf, default /var/log/kern.log captures only the kernel's messages of any loglevel; i.e. the output of dmesg.

/var/log/messages instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.

/var/log/syslog in turn logs everything, except auth related messages.

Other insteresting standard logs managed by syslog are /var/log/auth.log, /var/log/mail.log.

Regarding your question: if you need solely kernel messages log, use the kern.log or call dmesg.

share|improve this answer
any references to you claims please? – Goaler444 May 29 '13 at 19:14
@Goaler444, man syslog.conf. – ulidtko May 31 '13 at 10:32
Note that entries in the kernel ring buffer (what dmesg reads) won't make it into any /var/log file by default if they were written by a user space process. You need to set $KLogPermitNonKernelFacility on in rsyslogd's config if you want to see those messages in /var/log. See my answer at for more details. – Matthew Phipps Jul 2 '14 at 17:54
also worth noting that ubuntu (since natty) no longer uses /var/log/messages, and stores everything on /var/log/syslog – jackbravo Jan 23 '15 at 17:29
  • syslog contains all the messages except of type auth.
  • messages contains only generic non-critical messages. The category is info , notice and warn
  • For complete log look at /var/log/syslog and /var/log/auth.log
  • AFAIK /var/log/kern.log contains kernel messages.
  • log files are just a convention spelled out in /etc/syslog.conf
  • read syslog(3) for more information

Check this page about differences between messages and syslog

it says /var/log/messages /var/log/syslog

share|improve this answer
The link you provided is broken. – slm Jun 13 '13 at 7:50
@slm Here is the archived version. – ignis Aug 25 '13 at 11:30
Duplicating the comment an ulidtko's answer: also worth noting that ubuntu (since natty) no longer uses /var/log/messages, and stores everything on /var/log/syslog – jackbravo Jan 23 '15 at 17:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.