Novice Academy: Find out the ins and outs of Linux log processing

Everyone who uses UNIX/LINUX knows the usefulness of the log. So, do you know the ins and outs of the processing of Linux log information?

We can see the following two ways of LINUX system information log:

(1)dmesg view----This command is more common

(2) Files under /var/log/

Let's start from these 2 ways, step by step.

(1) First, let's look at the common command dmesg. What is hidden behind!!

(1) Let us come to MAN this guy

-------------man dmesg----- ---------------------

NAME

dmesg - print or control the kernel ring buffer

SYNOPSIS

dmesg [ -c ] [ -n level ] [ -s bufsize ]

DESCRIPTION

dmesg is used to examine or control the kernel ring buffer.

The program helps users to print out their bootup mes- sages. Instead of copying the messages by hand, the user need only:

dmesg > boot.messages

and mail the boot .messages file to whoever can debug their

problem.

OPTIONS

-c Clear the ring buffer contents after printing.

-sbufsize

Use a Buffer of size bufsize to query the kernel ring buffer. This is 16392 by default. (The default kernel syslog buffer size was 4096 at first, 8192 since 1.3.54, 16384 since 2.1.113.) If you have set the kernel buffer to Be larger than the default then this option can be used to view the entire buffer.

-nlevel

Set the level at which logging of messages is done to the console. For example, -n 1 prevents all messages, expect panic messages, from appearing on the console. All levels of messages are still written to /proc/kmsg, so syslogd(8) can still be used to control exactly where kernel messages appear.

When the -n option is used, dmesg will not print or clear the kernel ring buffer.

When both options are used, only the last option on the command line will have an effect.

From the manual provided by LINUX, we can know that the most important information dmesg is to read information from the kernel's ring buffer.

(2) What is the ring buffer?

At In LINUX, all system information (package kernel information) is transferred to the ring buffer. The information generated by the kernel is printed by printk(). The information you see when the system starts is printed by the function to the screen. The information printed by printk() tends to indicate the importance level of the message with a number of <0><2>. Above a certain priority level will be printed on the screen, otherwise it will only remain in the system's buffer (ring buffer).

As for dmesg, how to read from the ring buffer, you can see the dmesg.c source code. Very short, easier to read.

(2) How to do dmesg It should be very clear. As for the files under /var/log/, you are familiar with it and can't be familiar with it again!

(1)/var/log/.. Why are there so many files? Br>

Explanation: The syslogd daemon logs the logs generated by different services to different files according to /etc/syslog.conf.

where /etc/syslog.conf I won't go into details, a lot of information about this (check it).

(2) Now that I know, /var/log/.. is generated by the daemon process syslogd. Then again Go along this line.

After the Linux system is started, klogd and syslogd are started by /etc/init.d/sysklogd.

The klogd will get the information sent by the kernel printk()

from the system buffer through the syslog() system call or the proc file system. The syslogd is Read the system kernel information through klogd.

I think at this point, everyone should feel the log generation, reading and other actions.

Summary:

(1) All system information is output to the ring buffer. The content displayed by .dmesg is also read from the ring buffer.

(2) /etc/init.d/sysklogd in LINUX system Will start 2 daemons: Klogd & & Syslogd

(3) klogd is responsible for reading the kernel information, there are 2 ways:

syslog () system call (this function usage More comprehensive, let's go to MAN to see)

Directly read /proc/kmsg (again, /proc/kmsg is the place to output kernel information)

(4) The output of Klogd will be sent to syslogd for processing. syslogd will output log

information to different files under /var/log/according to the configuration of /etc/syslog.conf.