^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) What: /dev/kmsg
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) Date: Mai 2012
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) KernelVersion: 3.5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) Contact: Kay Sievers <kay@vrfy.org>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) Description: The /dev/kmsg character device node provides userspace access
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) to the kernel's printk buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) Injecting messages:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) Every write() to the opened device node places a log entry in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) the kernel's printk buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) The logged line can be prefixed with a <N> syslog prefix, which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) carries the syslog priority and facility. The single decimal
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) prefix number is composed of the 3 lowest bits being the syslog
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) priority and the next 8 bits the syslog facility number.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) If no prefix is given, the priority number is the default kernel
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) log priority and the facility number is set to LOG_USER (1). It
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) is not possible to inject messages from userspace with the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) facility number LOG_KERN (0), to make sure that the origin of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) the messages can always be reliably determined.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) Accessing the buffer:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) Every read() from the opened device node receives one record
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) of the kernel's printk buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) The first read() directly following an open() always returns
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) first message in the buffer; there is no kernel-internal
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) persistent state; many readers can concurrently open the device
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) and read from it, without affecting other readers.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) Every read() will receive the next available record. If no more
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) records are available read() will block, or if O_NONBLOCK is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) used -EAGAIN returned.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) Messages in the record ring buffer get overwritten as whole,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) there are never partial messages received by read().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) In case messages get overwritten in the circular buffer while
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) the device is kept open, the next read() will return -EPIPE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) and the seek position be updated to the next available record.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) Subsequent reads() will return available records again.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) Unlike the classic syslog() interface, the 64 bit record
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) sequence numbers allow to calculate the amount of lost
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) messages, in case the buffer gets overwritten. And they allow
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) to reconnect to the buffer and reconstruct the read position
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) if needed, without limiting the interface to a single reader.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) The device supports seek with the following parameters:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) SEEK_SET, 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) seek to the first entry in the buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) SEEK_END, 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) seek after the last entry in the buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) SEEK_DATA, 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) seek after the last record available at the time
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) the last SYSLOG_ACTION_CLEAR was issued.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) Other seek operations or offsets are not supported because of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) the special behavior this device has. The device allows to read
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) or write only whole variable length messages (records) that are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) stored in a ring buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) Because of the non-standard behavior also the error values are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) non-standard. -ESPIPE is returned for non-zero offset. -EINVAL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) is returned for other operations, e.g. SEEK_CUR. This behavior
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) and values are historical and could not be modified without the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) risk of breaking userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) The output format consists of a prefix carrying the syslog
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) prefix including priority and facility, the 64 bit message
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) sequence number and the monotonic timestamp in microseconds,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) and a flag field. All fields are separated by a ','.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) Future extensions might add more comma separated values before
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) the terminating ';'. Unknown fields and values should be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) gracefully ignored.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) The human readable text string starts directly after the ';'
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) and is terminated by a '\n'. Untrusted values derived from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) hardware or other facilities are printed, therefore
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) all non-printable characters and '\' itself in the log message
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) are escaped by "\x00" C-style hex encoding.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) A line starting with ' ', is a continuation line, adding
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) key/value pairs to the log message, which provide the machine
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) readable context of the message, for reliable processing in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) userspace.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) Example::
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) 7,160,424069,-;pci_root PNP0A03:00: host bridge window [io 0x0000-0x0cf7] (ignored)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) SUBSYSTEM=acpi
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) DEVICE=+acpi:PNP0A03:00
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) 6,339,5140900,-;NET: Registered protocol family 10
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) 30,340,5690716,-;udevd[80]: starting version 181
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) The DEVICE= key uniquely identifies devices the following way:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) ============ =================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) b12:8 block dev_t
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) c127:3 char dev_t
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) n8 netdev ifindex
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) +sound:card0 subsystem:devname
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) ============ =================
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) The flags field carries '-' by default. A 'c' indicates a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) fragment of a line. Note, that these hints about continuation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) lines are not necessarily correct, and the stream could be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) interleaved with unrelated messages, but merging the lines in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) the output usually produces better human readable results. A
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) similar logic is used internally when messages are printed to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) the console, /proc/kmsg or the syslog() syscall.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) By default, kernel tries to avoid fragments by concatenating
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) when it can and fragments are rare; however, when extended
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) console support is enabled, the in-kernel concatenation is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) disabled and /dev/kmsg output will contain more fragments. If
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) the log consumer performs concatenation, the end result
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) should be the same. In the future, the in-kernel concatenation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) may be removed entirely and /dev/kmsg users are recommended to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) implement fragment handling.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) Users: dmesg(1), userspace kernel log consumers