dev-kmsg 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127
  1. What: /dev/kmsg
  2. Date: Mai 2012
  3. KernelVersion: 3.5
  4. Contact: Kay Sievers <[email protected]>
  5. Description: The /dev/kmsg character device node provides userspace access
  6. to the kernel's printk buffer.
  7. Injecting messages:
  8. Every write() to the opened device node places a log entry in
  9. the kernel's printk buffer.
  10. The logged line can be prefixed with a <N> syslog prefix, which
  11. carries the syslog priority and facility. The single decimal
  12. prefix number is composed of the 3 lowest bits being the syslog
  13. priority and the next 8 bits the syslog facility number.
  14. If no prefix is given, the priority number is the default kernel
  15. log priority and the facility number is set to LOG_USER (1). It
  16. is not possible to inject messages from userspace with the
  17. facility number LOG_KERN (0), to make sure that the origin of
  18. the messages can always be reliably determined.
  19. Accessing the buffer:
  20. Every read() from the opened device node receives one record
  21. of the kernel's printk buffer.
  22. The first read() directly following an open() always returns
  23. first message in the buffer; there is no kernel-internal
  24. persistent state; many readers can concurrently open the device
  25. and read from it, without affecting other readers.
  26. Every read() will receive the next available record. If no more
  27. records are available read() will block, or if O_NONBLOCK is
  28. used -EAGAIN returned.
  29. Messages in the record ring buffer get overwritten as whole,
  30. there are never partial messages received by read().
  31. In case messages get overwritten in the circular buffer while
  32. the device is kept open, the next read() will return -EPIPE,
  33. and the seek position be updated to the next available record.
  34. Subsequent reads() will return available records again.
  35. Unlike the classic syslog() interface, the 64 bit record
  36. sequence numbers allow to calculate the amount of lost
  37. messages, in case the buffer gets overwritten. And they allow
  38. to reconnect to the buffer and reconstruct the read position
  39. if needed, without limiting the interface to a single reader.
  40. The device supports seek with the following parameters:
  41. SEEK_SET, 0
  42. seek to the first entry in the buffer
  43. SEEK_END, 0
  44. seek after the last entry in the buffer
  45. SEEK_DATA, 0
  46. seek after the last record available at the time
  47. the last SYSLOG_ACTION_CLEAR was issued.
  48. Other seek operations or offsets are not supported because of
  49. the special behavior this device has. The device allows to read
  50. or write only whole variable length messages (records) that are
  51. stored in a ring buffer.
  52. Because of the non-standard behavior also the error values are
  53. non-standard. -ESPIPE is returned for non-zero offset. -EINVAL
  54. is returned for other operations, e.g. SEEK_CUR. This behavior
  55. and values are historical and could not be modified without the
  56. risk of breaking userspace.
  57. The output format consists of a prefix carrying the syslog
  58. prefix including priority and facility, the 64 bit message
  59. sequence number and the monotonic timestamp in microseconds,
  60. and a flag field. All fields are separated by a ','.
  61. Future extensions might add more comma separated values before
  62. the terminating ';'. Unknown fields and values should be
  63. gracefully ignored.
  64. The human readable text string starts directly after the ';'
  65. and is terminated by a '\n'. Untrusted values derived from
  66. hardware or other facilities are printed, therefore
  67. all non-printable characters and '\' itself in the log message
  68. are escaped by "\x00" C-style hex encoding.
  69. A line starting with ' ', is a continuation line, adding
  70. key/value pairs to the log message, which provide the machine
  71. readable context of the message, for reliable processing in
  72. userspace.
  73. Example::
  74. 7,160,424069,-;pci_root PNP0A03:00: host bridge window [io 0x0000-0x0cf7] (ignored)
  75. SUBSYSTEM=acpi
  76. DEVICE=+acpi:PNP0A03:00
  77. 6,339,5140900,-;NET: Registered protocol family 10
  78. 30,340,5690716,-;udevd[80]: starting version 181
  79. The DEVICE= key uniquely identifies devices the following way:
  80. ============ =================
  81. b12:8 block dev_t
  82. c127:3 char dev_t
  83. n8 netdev ifindex
  84. +sound:card0 subsystem:devname
  85. ============ =================
  86. The flags field carries '-' by default. A 'c' indicates a
  87. fragment of a line. Note, that these hints about continuation
  88. lines are not necessarily correct, and the stream could be
  89. interleaved with unrelated messages, but merging the lines in
  90. the output usually produces better human readable results. A
  91. similar logic is used internally when messages are printed to
  92. the console, /proc/kmsg or the syslog() syscall.
  93. By default, kernel tries to avoid fragments by concatenating
  94. when it can and fragments are rare; however, when extended
  95. console support is enabled, the in-kernel concatenation is
  96. disabled and /dev/kmsg output will contain more fragments. If
  97. the log consumer performs concatenation, the end result
  98. should be the same. In the future, the in-kernel concatenation
  99. may be removed entirely and /dev/kmsg users are recommended to
  100. implement fragment handling.
  101. Users: dmesg(1), userspace kernel log consumers