68

For the purposes of kernel logging, why do I have three different, non-inclusive levels of logging amongst /var/log/messages, /var/log/syslog, and /var/log/kern.log?

  • Note that /var/log/messages is the syslog on non-Debian/non-Ubuntu systems such as RHEL or CentOS systems usually. – Thomas Ward Oct 3 '18 at 15:42
  • Note that journalctl is slowly replacing syslog as go to resource for monitoring system messages. – WinEunuuchs2Unix Oct 3 '18 at 17:53
52

Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under /var/log. In some datacenter setups there are hundreds of devices each with its own log; syslog comes in handy here too. One just sets up a dedicated syslog server which collects all the individual device logs over the network. Syslog can also save logs to databases, and other clients.

According to my /etc/syslog.conf, default /var/log/kern.log captures only the kernel's messages of any loglevel; i.e. the output of dmesg.

/var/log/messages instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.

/var/log/syslog in turn logs everything, except auth related messages.

Other insteresting standard logs managed by syslog are /var/log/auth.log, /var/log/mail.log.

Regarding your question: if you need solely kernel messages log, use the kern.log or call dmesg.

  • 1
    any references to you claims please? – Goaler444 May 29 '13 at 19:14
  • 8
    @Goaler444, man syslog.conf. – ulidtko May 31 '13 at 10:32
  • 2
    Note that entries in the kernel ring buffer (what dmesg reads) won't make it into any /var/log file by default if they were written by a user space process. You need to set $KLogPermitNonKernelFacility on in rsyslogd's config if you want to see those messages in /var/log. See my answer at askubuntu.com/a/490900/297973 for more details. – Vanessa Phipps Jul 2 '14 at 17:54
  • 7
    also worth noting that ubuntu (since natty) no longer uses /var/log/messages, and stores everything on /var/log/syslog – jackbravo Jan 23 '15 at 17:29
  • 1
    in Ubuntu 16.04 /var/log/syslog is indeed a clean superset of /var/log/kern.log with the caveat that one has to account for different rotation strategies. E.g. in my system (default config unchanged) today's and yesterday's messages are kept in a single file in /var/log/kern.log whereas most of yesterday's messages for syslog are in /var/log/syslog.1. – Marcus Junius Brutus Nov 12 '16 at 18:25
12
  • syslog contains all the messages except of type auth.
  • messages contains only generic non-critical messages. The category is info , notice and warn
  • For complete log look at /var/log/syslog and /var/log/auth.log
  • AFAIK /var/log/kern.log contains kernel messages.
  • log files are just a convention spelled out in /etc/syslog.conf
  • read syslog(3) for more information

Check this page about differences between messages and syslog

it says /var/log/messages /var/log/syslog

  • 1
    The link you provided is broken. – slm Jun 13 '13 at 7:50
  • 2
    @slm Here is the archived version. – ignis Aug 25 '13 at 11:30
  • 4
    Duplicating the comment an ulidtko's answer: also worth noting that ubuntu (since natty) no longer uses /var/log/messages, and stores everything on /var/log/syslog – jackbravo Jan 23 '15 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.