LInux kernel log

Question

I'm running embedded Linux (Angstrom distribution, for Atmel). I would like to read the kernel message log during shutdown, same stuff I'd get with dmesg. Basically I'm exploring a few issues I have by inserting printk() in the kernel code and now I'd like to see their output.

I found logs aren't automatically started when the system powers up (how can I?) and I cannot obtain anything with klogd command.

Hi @stef, may you please try `cat /var/log/messages` or `cat /var/log/kern.log`? — Dien Nguyen, Oct 03 '12 at 00:50
I haven't those files, there's exactly the ones I'd like to create. — stef, Oct 03 '12 at 17:04
Apparently angstrom do not store the log in the usual places and i'm also failing miserably to find any information. being able to tail -f or rotate logs would be nice... — gcb, May 31 '14 at 07:24

score 0 · Answer 1 · answered Oct 03 '12 at 07:59

If klogd is started too late or stopped too early for you to see your messages, maybe you could give a try to Netconsole ?

If you have a network access to your embedded board, of course. This module is easy to configure and I've used it successfully a couple of times in the past. Note that if you want to be able to see messages emited very early/late in the boot process, you will have to compile it inside the kernel (with your Ethernet driver), not as a module.

Also, check your default log level allows your printk() to be displayed (loglevel= kernel boot parameter)

score 0 · Answer 2 · answered Oct 06 '12 at 18:47

0

The trusty RS232 serial console is probably your friend in circumstances like these.

Unless you've taken steps to disable it, kernel log messages will almost certainly be finding their way there.

answered Oct 06 '12 at 18:47

marko

9,029
4
30
46

score 0 · Answer 3 · edited May 23 '17 at 12:00

Different distro may redirect the output of /proc/kmsg to any physical log files or virtual devices (/dev/xxx) they like. But "/proc/kmsg" is the original ultimate source of the kernel log, as the kernel actually implement its ring buffer operation inside fs/proc/kmsg.c:

static const struct file_operations proc_kmsg_operations = {
        .read           = kmsg_read,
        .poll           = kmsg_poll,
        .open           = kmsg_open,
        .release        = kmsg_release,
        .llseek         = generic_file_llseek,
};

And here is more info:

How to read ring buffer within linux kernel space?

So how you see the output is this:

sudo tail -f /proc/kmsg

And you can only see all the messages generated AFTER you have issued this command - all previous messages in the ring buffer will not be printed out. And so to see the physical file output, you can search for the user of "/proc/kmsg":

sudo lsof |grep proc.kmsg

And my machine indicated this:

rsyslogd  1743               syslog    3r      REG                0,3          0 4026532041 /proc/kmsg
in:imuxso 1743 1755          syslog    3r      REG                0,3          0 4026532041 /proc/kmsg
in:imklog 1743 1756          syslog    3r      REG                0,3          0 4026532041 /proc/kmsg
rs:main   1743 1757          syslog    3r      REG                0,3          0 4026532041 /proc/kmsg

So now it is pid 1743, let's see the files fd opened by 1743:

sudo ls -al /proc/1743/fd

lrwx------ 1 root   root   64 Dec 11 08:36 0 -> socket:[14472]
l-wx------ 1 root   root   64 Dec 11 08:36 1 -> /var/log/syslog
l-wx------ 1 root   root   64 Dec 11 08:36 2 -> /var/log/kern.log
lr-x------ 1 root   root   64 Dec 11 08:36 3 -> /proc/kmsg
l-wx------ 1 root   root   64 Dec 11 08:36 4 -> /var/log/auth.log

And so there you go, pid 1743 is rsyslogd, and it redirect the output of /proc/kmsg to files like /var/log/syslog and /var/log/kern.log etc.

LInux kernel log

3 Answers3