# Linux Kernel Logging

Kernel code can log with the printk() call, which has the same basic signature as printf(). Most calls appear to have an initial argument specifying the log level, but this is in fact a string constant which relies on C string literal concatenation:

printk(KERN_CRIT "oops");

This log level can be any of the following:

Symbol Value Meaning
KERN_EMERG “<0>” Emergency messages (precede a crash)
KERN_ALERT “<1>” Error requiring immediate attention
KERN_CRIT “<2>” Critical error (hardware or software)
KERN_ERR “<3>” Error conditions (common in drivers)
KERN_WARNING “<4>” Warning conditions (could lead to errors)
KERN_NOTICE “<5>” Not an error but a significant condition
KERN_INFO “<6>” Informational message
KERN_DEBUG “<7>”' Used only for debug messages
KERN_DEFAULT “<d>” Default kernel logging level
KERN_CONT “<c>” Continuation of a log line (avoid adding new time stamp)

The printk() call is safe from any context within the kernel and is implemented as a call to the non-variadic vprintk().

In cases where code may produce large amounts of output (e.g. logging an error on receipt of a network packet), the function printk_ratelimit() can be used, which discards output which occurs after a configurable number of messages within a configurable time frame.

Within the kernel, log messages go to a ring buffer where they're then made available to user-space for logging to files. The flow within the kernel looks like:

Note: klogctl() is the glibc function wrapper, the underlying system call name is syslog(). Using that name would have caused confusion with the user-space syslog() call, however.

The log level is available for use by user-space daemons (e.g. syslog) to determine whether to place the message in a log file. There is an additional in-kernel threshold which determines whether the message is sent directly to the console, and also a configurable default level for printk() calls which don't specify a level of their own.

The klogctl() function can be used to read from the log and also clear it, as well as configure which log messages are sent to the console. The dmesg command-line utility uses this system call to provide access to the buffer, both to read and clear it.

In addition to the system call, there is a /proc interface which exports the following files:

Path Meaning
/proc/sys/kernel/printk Current threshold levels: console, default, minimum console, default console.
/proc/sys/kernel/printk_delay Delay in milliseconds between messages — defaults to zero, read-only in /proc.
/proc/sys/kernel/printk_ratelimit Period in seconds over which printk_ratelimit() messages should be measure.
/proc/sys/kernel/printk_ratelimit_burst Maximum number of printk_ratelimit() messages to allow in the period specified by the above setting.