For the purposes of kernel logging, why do I have three different, non-inclusive levels of logging amongst
Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under
/var/log. In some datacenter setups there are hundreds of devices each with its own log; syslog comes in handy here too. One just sets up a dedicated syslog server which collects all the individual device logs over the network. Syslog can also save logs to databases, and other clients.
According to my
/var/log/kern.log captures only the kernel's messages of any loglevel; i.e. the output of
/var/log/messages instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.
/var/log/syslog in turn logs everything, except auth related messages.
Other insteresting standard logs managed by syslog are
Regarding your question: if you need solely kernel messages log, use the
kern.log or call
- syslog contains all the messages except of type auth.
- messages contains only generic non-critical messages. The category is
- For complete log look at
/var/log/kern.logcontains kernel messages.
- log files are just a convention spelled out in /etc/syslog.conf
syslog(3)for more information
Check this page about differences between messages and syslog