Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

For the purposes of kernel logging, why do I have three different, non-inclusive levels of logging amongst /var/log/messages, /var/log/syslog, and /var/log/kern.log?

share|improve this question
add comment

2 Answers 2

up vote 14 down vote accepted

Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under /var/log. There are also possibilities to send the messages to another host over network, to a serial console, to a database table, etc.

According to my /etc/syslog.conf, default /var/log/kern.log captures only the kernel's messages of any loglevel; i.e. the output of dmesg.

/var/log/messages instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.

/var/log/syslog in turn logs everything, except auth related messages.

Other insteresting standard logs managed by syslog are /var/log/auth.log, /var/log/mail.log.

Regarding your question: if you need solely kernel messages log, use the kern.log or call dmesg.

share|improve this answer
    
any references to you claims please? –  Goaler444 May 29 '13 at 19:14
1  
@Goaler444, man syslog.conf. –  ulidtko May 31 '13 at 10:32
    
Note that entries in the kernel ring buffer (what dmesg reads) won't make it into any /var/log file by default if they were written by a user space process. You need to set $KLogPermitNonKernelFacility on in rsyslogd's config if you want to see those messages in /var/log. See my answer at askubuntu.com/a/490900/297973 for more details. –  Matthew Phipps Jul 2 at 17:54
add comment
  • syslog contains all the messages except of type auth.
  • messages contains only generic non-critical messages. The category is info , notice and warn
  • For complete log look at /var/log/syslog and /var/log/auth.log
  • AFAIK /var/log/kern.log contains kernel messages.
  • log files are just a convention spelled out in /etc/syslog.conf
  • read syslog(3) for more information

Check this page about differences between messages and syslog

it says /var/log/messages /var/log/syslog

share|improve this answer
1  
The link you provided is broken. –  slm Jun 13 '13 at 7:50
1  
@slm Here is the archived version. –  ignis Aug 25 '13 at 11:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.