Difference between /var/log/messages, /var/log/syslog, and /var/log/kern.log?

Question

For the purposes of kernel logging, why do I have three different, non-inclusive levels of logging amongst /var/log/messages, /var/log/syslog, and /var/log/kern.log?

Answer 1

Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under /var/log. There are also possibilities to send the messages to another host over network, to a serial console, to a database table, etc.

According to my /etc/syslog.conf, default /var/log/kern.log captures only the kernel's messages of any loglevel; i.e. the output of dmesg.

/var/log/messages instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.

/var/log/syslog in turn logs everything, except auth related messages.

Other insteresting standard logs managed by syslog are /var/log/auth.log, /var/log/mail.log.

Regarding your question: if you need solely kernel messages log, use the kern.log or call dmesg.

Answer 2

• syslog contains all the messages except of type auth.
• messages contains only generic non-critical messages. The category is info , notice and warn
• For complete log look at /var/log/syslog and /var/log/auth.log
• AFAIK /var/log/kern.log contains kernel messages.
• log files are just a convention spelled out in /etc/syslog.conf
• read syslog(3) for more information

Check this page about differences between messages and syslog

it says /var/log/messages ⊂ /var/log/syslog